Unsurprisingly, schools, companies, and others that have amassed student information have been unable to adequately safeguard it. They simply cannot keep up with all the data they have collected and have routinely experienced data breaches. These breaches have compromised grades, student financial information, Social Security numbers, and even special education records. Congress charged the US Department of Education (ED) with enforcing the Family Educational Rights and Privacy Act (FERPA)--the main federal student privacy law--when it passed the law in 1974. Yet ED rarely investigates alleged FERPA violations or finds that schools have violated the law. Nor has the Federal Trade Commission, which has authority over the actions of private companies collecting student information, stepped in to investigate the behaviors of these companies. More can and should be done at both the state and federal levels to protect student privacy. Congress should bolster federal baseline student privacy protections and not preempt states from enacting laws that provide additional protections. Federal leadership in student data privacy can reduce the burden on states by aligning and clarifying the current patchwork of federal laws and by helping advance the education sector's capacity to protect student information. This article presents the perspectives of two experts in this field.