If you have a child in school you might be very surprised to learn that detailed information about the student might wind up in the hands of an unknown third party - all without your knowledge.

Students in classroom (AVAVA, ThinkStock)

How is this possible?

A little known law called the Family Educational Rights and Privacy Act (FERPA) of 1974 allows data brokers and others to get access to school “directory information” about students, unless a parental opt-out form has been signed by a parent or guardian at the beginning of the school year.

“This can be sensitive information, including a student’s home address, email, telephone number, date and place of birth, height, weight and even a photo of the child,” said Pam Dixon, executive director of the World Privacy Forum.

Dixon said when the law was written back in the 1970s this information didn’t seem to be potentially harmful, and it was probably kept locked away in some old filing cabinet at school, but now, with the Internet things are very different.

“If you have a photograph of a child, plus their home address and their email address that can be shared with third parties that are unknown to you and unknown to the school - that’s a problem,” Dixon said, “The majority of parents don’t know much about this and I have to tell you a lot of schools also are not up on this.”

She stressed schools mean well, and education officials no doubt care about student privacy, but she said she has witnesses a lot of situations where schools have been caught "flat-footed.”

The FERPA opt-out form is usually sent home with other paperwork at the beginning of the school year, and many parents may not even realize what it is, or how important it can be.

“When you turn it in, you basically tell the school what you do and don’t want them to share,” Dixon said.

If the student's information should appear on a data broker list, it doesn’t mean the school itself sold the information, according to Dixon.  The more likely scenario, according to Dixon, is a company gathers the information of everyone who didn’t opt-out and they sell it to the date brokers.

“There is a quiet world of marketing going on and some of the marketing is fine, but not all of it is and not all parents want their kids marketed to by unknown parties,”Dixon said.

Financial marketing, particularly for older students, can be annoying and turn into a real problem.

Congress may soon begin a FERPA review to see if tougher privacy protections should be enacted.