FOIA Redaction: How Government Agencies Redact Public Records Correctly

The federal government received more than 1.1 million FOIA requests in fiscal year 2023, a record high and the first time annual requests topped one million, according to the Department of Justice's Office of Information Policy. State and local agencies handle millions more under their own open-records laws. Every one of those requests forces an agency to answer the same question: what must be disclosed, and what must be withheld? Get it wrong in either direction and you face lawsuits, privacy breaches, or both.

Freedom of information redaction sits at the center of that tension. The Freedom of Information Act (FOIA) establishes a presumption of openness: government records are public unless a specific exemption applies. But when an exemption does apply, the agency must redact the exempt material and release everything else. That obligation, known as the "reasonably segregable" requirement, makes FOIA document redaction one of the most demanding redaction workflows in any sector.

This guide walks through the exemptions that trigger redaction, what the law requires, the mistakes agencies make most often, and how to build a process that holds up under judicial review.

The nine FOIA exemptions that require redaction

FOIA contains nine exemptions under 5 U.S.C. 552(b)(1) through (b)(9). Not all of them come up equally.

Exemption 1: Classified national security information

Covers material properly classified under an executive order. Agencies must confirm the classification is current and properly applied. This exemption is reviewed de novo by courts, meaning a judge can look behind the classification to determine if it was warranted.

Exemption 2: Internal personnel rules and practices

Narrowed significantly by the Supreme Court in Milner v. Department of the Navy (2011). Now limited to records related to employee relations and human resources practices. It rarely drives large-scale redaction.

Exemption 3: Information exempt under other statutes

Applies when another federal statute specifically prohibits disclosure. Examples include tax return information (26 U.S.C. 6103), grand jury material, and certain intelligence sources. The other statute must leave no discretion on disclosure.

Exemption 4: Trade secrets and confidential commercial information

One of the most frequently invoked FOIA exemptions for redaction. When agencies receive bids, contracts, financial statements, or technical data from private companies, those records may contain trade secrets or confidential commercial information. After Food Marketing Institute v. Argus Leader Media (2019), the Supreme Court broadened this exemption to cover information that is both customarily and actually kept private by the submitter.

Agencies routinely redact pricing terms, proprietary formulas, cost breakdowns, and technical specifications under Exemption 4. The challenge is distinguishing genuinely confidential commercial data from information that is already publicly available or that the submitter has not actually treated as confidential.

Exemption 5: Privileged inter-agency or intra-agency communications

Covers deliberative process privilege, attorney-client privilege, and attorney work product. Agencies use this to protect internal deliberations, draft policies, and legal advice. It does not protect purely factual material unless it is so intertwined with the deliberative process that disclosure would reveal the agency's reasoning.

Exemption 6: Personal privacy

This is the exemption that drives the most redaction volume across the federal government. It protects "personnel and medical files and similar files" where disclosure would constitute a "clearly unwarranted invasion of personal privacy." In practice, courts have interpreted "similar files" broadly to cover any record containing information about an identifiable individual.

Under Exemption 6, agencies redact names, Social Security numbers, home addresses, phone numbers, dates of birth, medical information, and other personally identifiable information. The balancing test weighs the public interest in disclosure against the privacy interest of the individuals named. If the information does not shed light on how the government is performing its duties, the privacy interest almost always wins.

For anyone processing FOIA requests, understanding what counts as PII and where it hides in documents is essential to applying Exemption 6 correctly.

Exemption 7: Law enforcement records

Exemption 7 has six sub-parts, and several of them generate heavy redaction:

• 7(A): Records from an ongoing investigation where disclosure could reasonably be expected to interfere with enforcement proceedings
• 7(C): Personal information in law enforcement records (a lower threshold than Exemption 6, requiring only that disclosure "could reasonably be expected" to constitute an unwarranted invasion of privacy)
• 7(D): Confidential source identities
• 7(E): Law enforcement techniques and procedures where disclosure would risk circumvention
• 7(F): Information that could endanger the life or physical safety of any individual

Exemption 7(C) is one of the most commonly cited bases for FOIA redaction in the entire statute. It protects the names and identifying details of law enforcement officers, witnesses, suspects who were investigated but not charged, and third parties mentioned in investigative files.

Exemption 8: Financial institution regulation

Covers examination, operating, and condition reports prepared by financial regulators. Rarely disputed because disclosure could undermine the stability of regulated institutions.

Exemption 9: Geological and geophysical information about wells

The narrowest exemption. It protects well data submitted by private companies to the government. It comes up almost exclusively in oil and gas contexts.

What "reasonably segregable" means

FOIA requires that "any reasonably segregable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt." This is not optional. An agency cannot withhold an entire document because one paragraph, one sentence, or even one name on the page falls under an exemption.

In practice, this means line-by-line and sometimes word-by-word review. If a memo contains three paragraphs of factual background and one paragraph of deliberative analysis, the agency must release the three factual paragraphs and redact only the deliberative one. If a law enforcement report names a confidential informant in one sentence but the rest of the page is non-exempt, the agency redacts that sentence and releases the page.

Courts take this requirement seriously. In multiple cases, judges have ordered agencies to go back and re-process records because they withheld entire pages or documents without demonstrating that non-exempt material could not be segregated. The Department of Justice OIP guidance emphasizes that agencies should make a conscious effort to release as much as possible.

This is where understanding what redaction actually is becomes critical. Redaction is not withholding. It is selectively removing exempt material while preserving and releasing everything else.

Common FOIA redaction mistakes

Government agencies process enormous volumes of records under tight statutory deadlines (20 business days for initial responses). That pressure leads to recurring mistakes.

Using visual overlays instead of permanent redaction

This is the most dangerous mistake. Some agencies or contractors place black boxes, white boxes, or highlight bars over sensitive text in a PDF without actually removing the underlying data. The document looks redacted on screen, but the text remains in the file. Anyone can select the area, copy, and paste the supposedly redacted content into a text editor.

This has happened publicly and repeatedly. Court filings, FOIA releases, and government reports have been published with "redacted" material that was trivially recoverable. For a detailed explanation of why visual masking fails, see how to redact documents safely. Before releasing any production, the free PDF Redaction Checker tests a document for recoverable text and lingering metadata in seconds, with no command-line tools required.

Over-redacting

Agencies sometimes apply exemptions too broadly, redacting material that does not actually qualify. Common patterns include:

• Redacting all names in a document under Exemption 6, even when some names are already public (e.g., senior officials acting in their official capacity, whose identity is a matter of public record)
• Applying Exemption 5 to factual material that was incorporated into a final policy document
• Withholding entire pages when only a few lines are exempt, violating the reasonably segregable requirement

Over-redaction is not just a transparency problem. It invites litigation. Requesters and news organizations routinely challenge excessive redactions, and courts have ordered agencies to release improperly withheld material, sometimes with attorneys' fees awarded to the requester.

Under-redacting

The opposite problem: missing PII or exempt material scattered throughout a document set. A single Social Security number buried in a footnote, a confidential source name mentioned in passing on page 47, an email address in a CC line. When agencies process hundreds or thousands of pages manually, these details slip through.

Under-redaction creates privacy breaches, potential violations of other statutes (like the Privacy Act), and loss of trust with the individuals whose information was exposed. Understanding the full scope of who needs redaction and why helps frame how seriously these lapses should be treated.

Inconsistent redaction across document sets

Large FOIA productions can span thousands of pages across multiple file types. If different reviewers apply different standards, or if the same name is redacted on one page but left visible on another, the entire production is compromised. Inconsistency also weakens the agency's litigation position because it suggests the exemption claims are not well-founded.

Failing to mark exemption codes on redacted portions

FOIA requires agencies to indicate which exemption justifies each redaction. A black bar with no label does not satisfy the statute. Requesters and courts need to know whether a redaction was made under Exemption 6, Exemption 7(C), Exemption 4, or another provision. Without that marking, the requester cannot meaningfully appeal, and the agency cannot defend its decisions.

FOIA redaction best practices

Building a defensible FOIA redaction process requires more than good intentions. Here is what holds up under review.

Mark every redaction with the applicable exemption code

Every redacted portion should be labeled with the specific exemption or exemptions that justify it. If a name is redacted under Exemption 7(C), the redaction mark should say "(b)(7)(C)" or an equivalent notation. If multiple exemptions apply, list all of them. This practice satisfies the statutory requirement, gives requesters the information they need to file an administrative appeal, and positions the agency to defend its decisions in litigation.

Use Vaughn indices for withheld documents

When entire documents or substantial portions are withheld, courts often require a Vaughn index: a detailed, document-by-document listing that describes each withheld record and explains which exemption applies to each portion. Named after Vaughn v. Rosen (1973), this tool forces agencies to justify their withholdings with specificity. Building the Vaughn index during processing, rather than after a lawsuit is filed, makes the entire production more defensible.

Verify redactions with copy-paste and text extraction tests

After applying redactions, test them. Select the redacted area and attempt to copy and paste. Run a text extraction tool against the file. Search for keywords that should have been removed. If any of these tests reveal the underlying text, the redaction is not complete. This verification step is non-negotiable for any production that will be released publicly or filed with a court.

Maintain a complete audit trail

Document every decision: who reviewed each record, which exemptions were considered, why specific material was redacted or released, and when the review was completed. This audit trail serves multiple purposes. It supports the agency in litigation. It enables consistent decisions when similar records come up in future requests. And it demonstrates good faith, which courts consider when evaluating whether an agency conducted an adequate search and review.

Process consistently across large document sets

Before starting a large production, establish written guidelines for the specific request. Define what categories of information will be redacted under which exemptions. Train all reviewers on those guidelines. Conduct quality checks on a sample of reviewed documents before finalizing the production. Consistency across the document set is both a legal requirement and a practical necessity.

How AI redaction tools help with FOIA volume

The scale of FOIA processing has outpaced what manual review can handle reliably. An agency responding to a single request may need to review 10,000 pages across emails, memos, spreadsheets, and scanned documents. Doing that manually, page by page, under a 20-day deadline is where mistakes happen.

AI-powered redaction tools address the core challenges:

Automated PII detection. Machine learning models scan entire document sets and flag names, Social Security numbers, dates of birth, phone numbers, email addresses, financial account numbers, and other PII categories. Reviewers start with a comprehensive map of where sensitive data appears rather than hunting for it manually.

Once an agency decides that a particular name or category of information should be redacted, the tool applies that decision uniformly across every page in the production. No more redacting a name on page 12 but missing it on page 340.

Modern tools also generate audit logs showing exactly what was redacted, where, when, and under what rule. That log becomes the foundation of the agency's litigation defense and its Vaughn index. Exemption code labeling can be configured to tag each redaction automatically, keeping productions compliant with FOIA's marking requirements without relying on reviewers to remember the right code for each passage.

Finally, automated verification confirms that redacted text is actually removed from the document structure, not just visually obscured. This eliminates the single most damaging redaction failure.

The practical result: a reviewer who spent hours scanning pages for stray SSNs now spends that time on judgment calls, like whether a passage is genuinely deliberative under Exemption 5, where human expertise actually matters.

Building a defensible FOIA redaction workflow

FOIA redaction is not just a technical task. It is a legal obligation that balances competing interests under judicial oversight. Agencies that invest in clear exemption guidelines, consistent review processes, proper redaction tools, and thorough verification will process requests faster, face fewer legal challenges, and better serve the public's right to know.

If your agency or organization handles FOIA requests or public records productions, RedactifyAI can help you process documents at scale with consistent PII detection, proper exemption labeling, and verified permanent redaction. Upload a sample record to the free redaction tool to see how it handles your document types before committing to a full production. Visit FOIA.gov for more on filing and processing requirements, and explore our guides on how to redact documents safely and what redaction means in practice for additional background.

Frequently asked questions

What can a federal agency redact in a FOIA response?

Anything covered by one of the nine FOIA exemptions in 5 U.S.C. § 552(b): national security, internal personnel rules, statutorily exempt material, trade secrets, internal memoranda, personal privacy, law enforcement records, financial regulator records, and geological information. Agencies must justify each redaction with reference to a specific exemption and apply the foreseeable harm standard.

What are the most-used FOIA exemptions for redaction?

Exemption 6 (personal privacy) and Exemption 7(C) (law enforcement personal privacy) are the most common, used to redact names, addresses, phone numbers, and other identifying details of third parties. Exemption 5 (deliberative process) covers internal pre-decisional discussion. Exemption 4 protects trade secrets and confidential business information.

Can I appeal a FOIA redaction?

Yes. Every agency has an administrative appeal process, typically requiring submission within 90 days of the response. After exhausting administrative appeals, requesters can file suit in federal district court. The court reviews the redactions de novo and can order additional disclosure if exemptions were applied too broadly.

How long should FOIA redaction review take?

Statute requires 20 business days for an initial response, often extended for unusual circumstances. Complex requests routinely take 6-18 months. The redaction review itself depends on volume; large productions can take additional months for line-by-line review. The OGIS dispute resolution service can help if delays exceed reasonable bounds.