Skip to main content

FAQ about HB1 – Virginia Code § 23.1-405(C)

Effective July 1, Virginia Code § 23.1-405(C) prohibits a college or university from disclosing a student’s email address, physical address or telephone number “unless the student affirmatively consented in writing” to the disclosure. For more details about this legislation and its impact on faculty, staff and students, please explore our FAQ below for a list of frequently asked questions. The FAQ page will be updated periodically to provide additional information.

What is HB1?

Effective July 1, 2018, Virginia House Bill 1 (HB1) amended Virginia Code section 23.1-405(C) to prohibit a college or university from disclosing a student’s email address, physical address or telephone number unless the student has affirmatively consented in writing to the disclosure.

Why was the statute changed?

Under the Family Educational Rights and Privacy Act (“FERPA”), certain basic student information, termed “directory information” (e.g., name, address, phone, year in school, major), may be disclosed without student consent. The change was born out of concerns for protecting student privacy. FERPA and FOIA allowed businesses and other organizations to obtain student information and send mass, unsolicited texts and emails. The revised statute requires that student contact information may be disclosed only if the student has affirmatively approved the disclosure in writing. Practical and operational consequences of this law may make internal communications more difficult than was likely intended.

What are the key takeaways regarding this statute?

  • This legislation covers students in all academic program levels: undergraduate and master’s.
  • Faculty and staff will continue to have access to contact information for all students; however, they will not be able to disclose that information to any individual other than a College employee or other “school official” (as that term is defined in the College’s FERPA policy) without the student’s written consent.
  • Students will no longer be able to find contact information for another student through the directory on the College’s website.

What does “consent” under the statute look like?

The consent must be wholly voluntary, in writing and must predate the disclosure. Please note:

  • Consent cannot be implied by virtue of a student’s participation in a class, team or activity; and
  • Consent cannot be required in order to participate in a class, team or activity.

What is the procedure and necessary paperwork to get student consent?

There is not a central database to verify whether a student has provided the requisite consent. Consent will need to be obtained on a case-by-case basis until a centralized database is developed. A standard consent form — FERPA Student Release Authorization (.pdf) — is available on the MyBC page if a faculty or staff member needs to disclose student contact information to someone other than a “school official,” as defined in the College’s FERPA policy. The faculty or staff member must keep a permanent copy of the written consent form, either in hard copy or as a saved PDF copy, until the consent is withdrawn.

How can faculty and staff access student contact information?

Student names and email addresses have been removed from the online directory through the publicly accessible website. By August 1, the current online student directory will be available for faculty and staff use with login. Students and the public will not be able to access this information. Additionally, faculty will retain access to student and class roster information in Moodle and Canvas.

Will faculty have access to student email addresses for students not enrolled in one of their courses?

Yes. Faculty members will have access to contact information for all students through the searchable student directory being developed by IT.

Can faculty and staff provide student contact information to another student?

Unless a student has provided affirmative written consent for the disclosure, faculty and staff members may not disclose student contact information – email address, phone number or physical address – to any individual who is not a College employee or other “school official” as defined in the College’s FERPA policy.

Can faculty and staff who coach teams or advise student organizations provide student contact information to other students on the team or in the organization?

Faculty and staff may not distribute a team or organization roster that includes student email addresses, phone numbers or physical addresses without written consent from each student whose information is provided.

Will group emails to multiple students be allowed

Yes, group emails to multiple students are still allowed; however, faculty and staff may not disclose a student’s contact information to another student. So, in order to email a group of students, the sender must add the students’ email addresses in the “bcc” field, not the “to” or “cc” field, or must use a listserv created by IT (e.g., Please note: personal email groups and group contact lists created by faculty and staff in Outlook are not listservs and do not protect the privacy of student email addresses. An email sent via an email group or contact list created in Outlook will show the email addresses of all members of the group when it is received.

You may create and use contact group email lists in your Outlook account by typing the group name in the BCC field. By doing this, you will not need to re-enter every email address individually in the BCC field for each email you send to a group of students. The following knowledgebase article provides information on creating new contact groups in Outlook:

What method can faculty and staff use to contact students?

The statute does not affect how faculty and staff contact students. Emails, phone calls, Moodle/Canvas, and in-person communications can still be used to interact with students. Faculty and staff members must take precautions, however, when using student contact information; without written consent from the student, faculty and staff members may not disclose a student’s email address, physical address, or phone number to another student or a non-College official.

How will the display of student information in course management systems be handled?

While the statute does not place restrictions on employees’ access to student contact information, it does prohibit disclosure of student contact information to other students. As such, class rosters with email addresses and/or phone numbers may not be made available to students. Please do not change the default settings in Moodle and Canvas. It is important that students not be able to access their classmates’ email addresses through Moodle or Canvas. Students are able to contact their classmates directly through Moodle and Canvas without access to student email information

What about when students are working together in groups?

If students are working in teams, they must exchange contact information among themselves. Absent written consent, faculty may not provide student contact information to another student

What about blogs used in classes?

College faculty and staff members may not disclose student contact information without affirmative written consent, regardless of the media used to publish or disclose the information.

How will this affect online courses?

The law does not distinguish between online and other courses. Absent written consent, the College may not disclose a student’s email address, physical address, or phone number to another student or a non-College official. Online instructors may need to revise the delivery and administration of an online course to avoid disclosing this information.

There are student workers and student assistants who routinely access the email address, phone number, or physical address of other students as a part of their work. Does their access need to be removed?

No. A student worker or assistant required to access this information as a part of their work duties is considered a “school official” under FERPA with the need to know this information. Student workers and assistants who have access to this information must be made aware that they may not disclose this information to others without supervisory authorization and written consent from the affected students. It is advisable to remind student workers and assistants who access this information that they may not access or use it for any purpose other than as necessary for their assigned work duties.

How does the legislation impact students?

The statute prohibits the College (and its employees, faculty and staff) from disclosing a student’s email address, physical address or telephone number unless the student has affirmatively consented in writing to the disclosure. Student-to-student contact, however, is unaffected by the statute. Students may freely disclose another student’s email address and phone number. The statute’s prohibition relates only to disclosure of this information by the College.

As a student, how do I find out another student’s contact information?

You may obtain a classmate’s contact information directly from the classmate or from a list or directory in which your classmate has given the College consent to post their contact information. The College cannot provide you with another student’s contact information unless that student has consented to the disclosure.

As a student, am I able to send group emails to other students?

The law restricts disclosure by the College but does not restrict any disclosure by students or others of information they lawfully possess. For example, if students in a student organization or club collect and distribute membership rosters, that disclosure is not restricted by this law. However, the College may no longer provide the contact information for these group rosters. As a best practice, we encourage students to seek permission, or permit objections, before publishing the contact information of others.

I can no longer group text my students but group text is a valuable communication tool. What are my options?

GroupMe is an example of a free iOS, Android and web messaging app that allows you to create a group chat that keeps user information private. Users can download the app and create a user name and upload a photo (if they choose). They can also receive group chats in their regular SMS messaging apps. The IT department has the names of several other apps that will function in a similar way. You can contact the helpdesk for more information.

Further questions?
If you have additional questions about Code of Virginia § 23.1-405(C), please contact Kristy Rhea ( or Roy Ferguson (