A few years ago when Esri made it possible to enable Esri Access at the organization level for ArcGIS Online, I was overjoyed! That is, until I found out that a new directive in the form of FERPA compliance was going to cause an issue for us.
Specifically, the bill states that full name and email address are not allowed to be disclosed to an outside organization except for the expressed purpose of the service without the student's written consent. Details are in the links at the bottom of this post.
According to the notification when enabling Esri Access:
As this means that Esri could contact our student for anything beyond information directly relating to our use of the service (access to Esri Training), we would need the written consent of each student, basically making the ability to set it as a default invalid.
I have spoken to other universities, and while they do not feel this is a problem, our university legal department has made clear this is indeed in conflict with FERPA and we cannot enable this feature. It seems to me that even if this is not a problem with other universities, it would be for grade school systems that maintain organization accounts and wish to use Esri Access.
What I would like to see is, at minimum, the ability to disable this contact functionality for organizational accounts with Esri Access at an organization level. I think our legal department would be even happier if no personal data was shared between the Esri and Org accounts beyond login.
I don't know if this is possible, but that seems like the only way we can enable this feature. Until then, I'll keep inviting students to join our org with a Public account of their choice, and them getting confused which account to use when. At least in this way the student decides whatever information they chose to disclose and not the university, taking the onus off us.
References: