About Code of Virginia § 23.1-405(C)

What is HB1?
Virginia House Bill 1 (HB1), effective July 1 as Code of Virginia section 23.1-405(C), prohibits a university from disclosing a student’s email address, physical address or telephone number under the exception in the Family Educational Rights and Privacy Act (FERPA) for directory information or the Virginia Freedom of Information Act (FOIA) unless the student has affirmatively consented in writing to the disclosure.

However, FERPA permits disclosure of student information without consent among school officials with a legitimate educational interest as described on VCU's FERPA webpage.

Read our HB1 FAQ or see our quick tips below.

Key points regarding this bill:

  • This legislation covers students in all academic program levels: undergraduate, master’s, doctoral, first professional and certificate.
  • Faculty will continue to have access to contact information for all students in their courses. They just will not be able to share that information without the student’s written consent.
  • Students will no longer be able to find contact information for another student through phonebook.vcu.edu or the people search on the VCU website. A student may choose to provide written consent to allow their contact information (name, email address) to be accessible.
  • University online applications — such as Blackboard, email, room reservation systems and Service Desk — will no longer provide the ability for non-employees to search for student eID and email addresses, including the auto-complete feature of email addresses currently used in many systems.

Other commonly asked questions about this legislation are answered in our HB1 FAQ:

Quick Tips for Fall 2018

Automated consent

  • Students can easily give consent to display their email address to other VCU students and members of the VCU Community by visiting myvcu.vcu.edu and activated the “privacy setting” toggle in the box in the upper left corner of the Student Tab.
  • Faculty and staff can determine if a student has provided consent through MyVCU by contacting departmental administrators who may access this information through a table in Banner. VCU Technology Services is working on a version of eID tools that will be made available to employees and will display the status of the student's consent.
  • Faculty may also suggest that students activate the toggle in MyVCU in the classes, on syllabi, etc.

Written consent

  • If a student has not provided consent through MyVCU or the contact information disclosure is outside of the scope of the MyVCU consent (e.g. contact information needs to be posted on a syllabus that will be made available on the Internet, student phone number needs to be made available to class, contact information needs to be posted on a collaborative website, etc.), written consent is needed. Suggested text for the request for consent is included in the first entry under “General” in the FAQ.

Students emailing students

  • Students can share their emails with each other, but faculty may not share student emails with other students.

Faculty emailing students

  • When emailing groups of students, particularly when you are unsure if one or more students have provided consent, place student emails in the BCC: area.
  • FERPA already permits disclosure of student information without consent among school officials with a legitimate educational interest as described on VCU's FERPA webpage.

Faculty emailing student teams

  • See above. If a faculty member wants to place student email addresses in the TO: area of an email message to ensure that student team members can REPLY ALL, each student on the team must provide consent.

Student employees, teaching assistants and graduate assistant emails

  • If you wish to place student email addresses on a syllabus, website, etc., you must ensure that the student has provided appropriate consent.


  • Blackboard is now configured to automatically blind carbon copy (bcc) all students that are setup as recipients of a message sent by the instructor through Blackboard. More information on this feature is also posted on the VCU Technology Services website


  • Top Hat, VCU’s chosen vendor for classroom response, is contracted by VCU designating them a school official and prohibiting them from disclosing student information. Therefore loading class rosters with student email addresses is permitted without student consent.

Further questions?

If you have additional questions about Code of Virginia § 23.1-405(C), please contact:

  • VCU Technology Services: Information Security Office (infosec@vcu.edu)
  • Academic Affairs: Records and Registration (rar@vcu.edu)