FERPA, Family Educational Rights and Privacy Act, explains that the military is allowed access to student records via the school directory (unless the student has requested the institution not release his or her information). Each federally-funded university should have a webpage discussing FERPA; here is SUNY's, where it states:

"P. to the military, directory information as it is presently defined under the Solomon Amendment, even if the institution has not designated such information as directory information in its policy.
Directory information that must be released to the military:
1. student’s name and address;
2. telephone listing;
3. date and place of birth;
4. class level (Freshman, sophomore etc.);
5. academic major;
6. degrees received; and
7. the educational institution in which the student was most recently enrolled.

Information that Institutions are not required to release to the military:
1. Directory information, but only if the student has requested that the University not release such information to anyone;
2. information the institution certifies it does not have; or
3. information not defined as directory information."