Wow. I hadn't actually considered that. I found this:

http://www2.ed.gov/policy/gen/guid/fpco/ferpa/parents.html

but it isn't helping me too much--is this what we're talking about?

"Under FERPA, a school may not generally disclose personally identifiable information from a minor student's education records to a third party unless the student's parent has provided written consent."