This post by my virtual world guru, Ener Hax, was too timely not to repost here:
i have written about FERPA a few times in the past, but always in relation to Second Life
it is against American law to disclose a student’s grade on an assignment or course through any means without the student’s written permission (or to disclose any personal information). FERPA is so tight that even a school within a university can not share student information with another school in that same university without the student’s written consent!
to go further, K-12 teachers and university professors can not share grades via email unless it is 100% secure. a teacher at My High School can never send an email regarding grades or personal student information to a student’s Gmail account
under FERPA, a school can outsource email but only if the service provider is subject to the same terms that the school is. Google is not subject to FERPA and the burden is on the school and not on Google to be compliant with FERPA
this same compliance applies to virtual worlds. that’s why the safest way to implement OpenSim is on your own institution’s firewalled servers or possibly via sim-on-a-stick (which is ideal since it is a closed individual system – dang, i need to start selling sim-on-a-stick and buy that south pacific island!) =)