The only legal limits would arise from FERPA, the federal student record law. That law says that a student's education records must be made available (to the student or parent, depending), and that disclosure outside the context of school requires permission. This law applies to any school that receives federal funding (and it may be difficult to determine if that is the case). Your name is included in the class of "Personally Identifiable Information". For minors, the legal rights created by the law initially are held by the parent, but transfer to the student they they become "eligible". You become "eligible" at age 18, or once you transfer to a post-secondary institution.
The general rule is that a school cannot disclose an education record without the written and signed consent of the student (or parent, when relevant). An education record can be disclosed in redacted form, eliminating PII. However,
there are also a number of exceptions where consent is not required. Most relevant to this case is that "directory information" can be disclosed, which
includes, but is not limited to, the student's name; address;
telephone listing; electronic mail address; photograph; date and place
of birth; major field of study; grade level; enrollment status (e.g.,
undergraduate or graduate, full-time or part-time); dates of
attendance; participation in officially recognized activities and
sports; weight and height of members of athletic teams; degrees,
honors, and awards received; and the most recent educational agency or
institution attended.
To take advantage of this exception, the institution has to have "given public notice to parents of students in attendance and eligible students in attendance at the agency or institution" regarding what information will be disclosed, they must allow a refusal to disclose, and must say when the refusal has to be given. This disclosure must be made annually, while the student is enrolled. Specifically,
An educational agency or institution may disclose directory
information about former students without complying with the notice
and opt out conditions in paragraph (a) of this section. However, the
agency or institution must continue to honor any valid request to opt
out of the disclosure of directory information made while a student
was in attendance unless the student rescinds the opt out request.
The requirements for giving notice about privacy policy are rather weak: the student does not have to be personally and clearly alerted to specific actions. Notice might have been given to parents, and might have been in the form of a large wall of information that is hard to interpret. Here is one typical notice for a university, which says that the notice is published in the "Master Schedule of Classes", which used to be a printed document but nobody uses it – they do however email everybody at the beginning of the year. If they failed to provide an opt out notice, that would be a violation, whereas if they provided notice and you didn't see it (for instance, you were under 18 when the annual notice was given), they would have complied.