105 ILCS 85/26

A school may not do either of the following: (1) Sell, rent, lease, or trade covered information. (2) Share, transfer, disclose, or provide access to a student's covered information to an entity or individual, other than the student's parent, school personnel, appointed or elected school board members or local school council members, or the State Board, without a written agreement, unless the disclosure or transfer is: (A) to the extent permitted by State or federal law, to law enforcement officials to protect the safety of users or others or the security or integrity of the operator's service; (B) required by court order or State or federal law; or (C) to ensure legal or regulatory compliance. This paragraph (2) does not apply to nonpublic schools.