The Family Educational Rights and Privacy Act (FERPA) grants students the right to examine and challenge their educational records, and limits the disclosure or information from students education records (broadly defined). FERPA allows educational institutions to release “directory information” about students, and to release official records (eg: grades, disciplinary standing, etc) either with a student’s permission, or under other special circumstances (eg: a health emergency, if subpoenaed, or otherwise required by law). Under FERPA, all rights provided rest with the student, even if the student is under 18 years old.
FERPA has serious implications about how student work and data can be used and presented. In order for student work to be presented openly (say, in a class blog or a book) they must consent and must have the ability to opt-out. This also applies to online data, so be careful what hosting you are using!