Summary. FOIA gives any person a right of access to federal agency records, subject to nine exemptions, and it is a powerful tool most businesses and litigators underuse. It produces inspection reports, complaint files, contract records, enforcement correspondence, communications with competitors, and the material an agency relied on in a rulemaking — often faster and cheaper than discovery, and available where no litigation exists. This guide covers how to draft a request that gets processed, the fee and expedited processing rules, the exemptions and how each is contested, the administrative appeal that must precede suit, and how FOIA litigation is conducted. It closes with the reverse-FOIA problem.

Three situations where FOIA is the right tool and is usually not considered:

A company is competing for a federal contract and wants to know what the incumbent is charging, what performance problems the agency has documented, and what the agency said internally about the requirement. Much of that is obtainable.

A company has been inspected and wants the inspector's notes, the internal referral memoranda, the agency's communications about the facility, and the enforcement history of comparable facilities. Much of that is obtainable.

A litigant is suing a regulated competitor and wants the competitor's submissions to the agency, the complaints filed against it, and the agency's correspondence. Some of that is obtainable, and the competitor will fight it.

FOIA is not discovery, and it is better in three respects: no lawsuit is required, the requester need not explain why, and the agency must search. It is worse in three others: it is slow, the exemptions are broad, and the agency has no incentive to hurry.

The right of access

5 U.S.C. § 552 requires each agency, on a request that reasonably describes the records and is made in accordance with published rules, to make the records promptly available to any person.

"Any person" — citizenship, residence, and purpose are irrelevant. Corporations, foreign nationals, journalists, and litigants all have the same right.

"Agency" means executive departments, military departments, government corporations, government-controlled corporations, and other establishments in the executive branch, including independent regulatory agencies. Not covered: Congress, the federal courts, the President's immediate personal staff and units whose sole function is to advise and assist the President, state and local agencies (covered by state law), private companies, and government contractors as such — though a contractor's records may be agency records if the agency created or obtained them and controls them.

"Agency records" means records that the agency created or obtained and that are within its control at the time of the request. Personal records of employees are not agency records; records the agency lawfully controls are, even if physically held elsewhere. Records on personal email or messaging accounts used for official business have been held to be agency records subject to search.

No obligation to create records. An agency need not answer questions, compile statistics that do not exist, or create a new document. Ask for records, not for information.

Drafting a request that works

The single most common failure is a request that is too broad, which produces either a rejection for failure to reasonably describe or a processing estimate measured in years.

Elements of a good request:

  1. Address it correctly. Each agency and frequently each component has its own FOIA office and its own portal. Sending a request to the wrong component starts the clock later or not at all.
  2. Invoke the statute and identify it as a FOIA request in the subject line and the first sentence.
  3. Describe the records with specificity: subject matter, date range, custodians or offices if known, document types, and any identifying numbers — a docket number, a contract number, a facility identifier, an inspection date, a complaint number.
  4. Explain how to search where you can. Suggesting search terms, systems, and offices is permitted and helps.
  5. State the fee category you claim and a fee ceiling you authorize, with a request to be contacted before exceeding it.
  6. Request a fee waiver if applicable, with the required showing.
  7. Request expedited processing if applicable, with the required certification.
  8. Ask for the format — electronic, native, with metadata where relevant.
  9. Request segregable portions of any withheld record and an itemization of what is withheld and under which exemption.
  10. Provide contact information and offer to narrow the request in a conversation.

Narrow deliberately. A request for "all documents concerning X" over ten years will be assigned to a complex queue. The same request limited to a defined office, a two-year period, and three document types may be processed in months.

Consider a series of requests rather than one large one — an initial narrow request to identify what exists, followed by targeted follow-ups.

Talk to the FOIA officer. These are professionals managing large backlogs, and a five-minute conversation about what exists and how it is organized frequently converts an unprocessable request into a workable one. Agencies are required to designate a FOIA Public Liaison to assist with exactly this.

Deadlines, fees, and expedition

Twenty business days to make a determination — whether to comply, and the scope of any withholding — with a ten-business-day extension in "unusual circumstances" (records in other offices, voluminous records, or the need to consult another agency), on written notice.

The determination is not production. Courts have held that the agency must, within the period, gather and review the responsive documents, determine which it will disclose, and inform the requester of the scope and of appeal rights — but actual production may follow. In practice, agencies with backlogs miss the deadline routinely.

Tolling. The agency may toll the clock once to seek information from the requester, and may toll as necessary to clarify fee issues.

Constructive exhaustion. If the agency fails to respond within the statutory period, the requester is deemed to have exhausted administrative remedies and may sue immediately — § 552(a)(6)(C). But if the agency responds before suit is filed, actual exhaustion is required, so the window closes when the response arrives.

Fee categories:

  • Commercial use requesters pay search, review, and duplication.
  • Educational and noncommercial scientific institutions and news media pay duplication only, after 100 free pages.
  • All other requesters pay search and duplication, with two hours of search and 100 pages free.

The category is determined by the requester's identity and intended use, not by the records sought. A law firm requesting records for a client's commercial matter is a commercial requester.

Fee waivers are available where disclosure is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of government, and is not primarily in the commercial interest of the requester. The showing must address the subject's connection to government operations, the informative value, the contribution to public understanding, and the significance of that contribution — and the requester must explain how it will disseminate the information. A commercial requester will not get a waiver, and asking for one on thin grounds slows the request.

No fees may be charged if the agency misses the statutory deadline, subject to exceptions for unusual circumstances with more than 5,000 pages.

Expedited processing is available where the requester demonstrates a compelling need: an imminent threat to life or physical safety, or — for a person primarily engaged in disseminating information — an urgency to inform the public about actual or alleged federal government activity. Agencies must decide within ten calendar days, and the certification must be made under penalty of perjury.

The exemptions

Nine, and the agency bears the burden on each. The FOIA Improvement Act of 2016 added a foreseeable harm requirement: an agency may withhold information only if it reasonably foresees that disclosure would harm an interest protected by an exemption, or if disclosure is prohibited by law. This is a significant limitation on discretionary withholding and it should be invoked expressly in every appeal.

Exemption 1 — Classified national defense and foreign policy information, properly classified under an executive order.

Exemption 2 — Internal personnel rules and practices. Narrowed substantially by Milner v. Department of the Navy to genuinely trivial internal matters — hiring rules, parking, leave — rather than the broad "high 2" category agencies previously claimed.

Exemption 3 — Information exempted by another statute that either requires withholding without discretion or establishes particular criteria. Hundreds of statutes qualify, including the Trade Secrets Act in some applications, tax return information under 26 U.S.C. § 6103, and grand jury material under Rule 6(e).

Exemption 4 — Trade secrets and commercial or financial information obtained from a person and privileged or confidential. The most important exemption for businesses.

Food Marketing Institute v. Argus Leader Media, 588 U.S. 427 (2019), substantially broadened it. The Court rejected the long-standing National Parks test requiring a showing of competitive harm, holding that "confidential" carries its ordinary meaning: information is confidential where it is customarily kept private, or at least closely held, by the person imparting it, and — where the government provided an assurance of privacy — that assurance is satisfied. The Court did not decide whether an assurance is always required.

Practical consequences: businesses submitting information to agencies should mark it confidential, maintain it as confidential internally, and obtain an assurance of confidentiality where possible. Requesters seeking a competitor's submissions face a materially harder task than before 2019, and should focus on whether the information was in fact closely held and whether the agency generated rather than obtained it.

Exemption 5 — Inter-agency or intra-agency memoranda not available by law to a party in litigation with the agency. In substance, the civil discovery privileges:

  • Deliberative process — predecisional and deliberative material, protecting the give-and-take of agency decision-making. U.S. Fish and Wildlife Service v. Sierra Club, Inc., 592 U.S. 261 (2021), held that draft biological opinions were protected because they reflected a preliminary view that never became final — but emphasized that the label "draft" is not dispositive and that the question is whether the document communicated a final decision. Note the 2016 amendment's twenty-five-year limit: the deliberative process privilege may not be invoked for records created twenty-five or more years before the request.
  • Attorney-client privilege and attorney work product, on the same terms as in litigation.
  • Presidential communications and, in some applications, the commercial information privilege for agency-generated information.

Exemption 5 is the most-invoked and most-contested exemption, and the foreseeable harm requirement bites hardest here — an agency asserting deliberative process must now articulate the harm, not merely the category.

Exemption 6 — Personnel, medical, and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy. A balancing test: the individual's privacy interest against the public interest in disclosure, with the public interest defined narrowly as shedding light on an agency's performance of its statutory duties. The requester's own purpose is irrelevant.

Exemption 7 — Records or information compiled for law enforcement purposes, to the extent disclosure would:

  • (A) interfere with enforcement proceedings;
  • (B) deprive a person of a fair trial;
  • (C) constitute an unwarranted invasion of personal privacy — note the lower threshold than Exemption 6, without "clearly";
  • (D) disclose the identity of a confidential source or information furnished by one;
  • (E) disclose techniques and procedures for investigations or prosecutions, or guidelines whose disclosure could reasonably be expected to risk circumvention of the law; or
  • (F) endanger the life or physical safety of any individual.

Exemption 8 — Records related to examination, operating, or condition reports of financial institutions. Broad, and it protects bank examination materials nearly categorically.

Exemption 9 — Geological and geophysical information concerning wells. Rarely used.

Glomar responses. Where confirming or denying the existence of records would itself reveal exempt information, an agency may refuse to confirm or deny. Most common with Exemptions 1, 6, 7(C), and 7(D). A Glomar response is contested by showing official acknowledgment — that the agency has already publicly confirmed the information's existence — or that the exemption does not apply.

Segregability. Section 552(b) requires that any reasonably segregable portion of a record be provided after deletion of exempt portions, and the agency must indicate the amount of information deleted and the exemption at the place of deletion where technically feasible. A wholesale withholding of a document containing factual material is a strong appeal point.

The administrative appeal

Required before suit unless the agency missed the deadline and has not yet responded.

Deadline: set by the agency's regulations, commonly 90 days from the determination, and sometimes shorter. Calendar it on receipt of the denial.

What to include:

  • Identification of the request, its tracking number, and the determination appealed.
  • Challenge the adequacy of the search, with specifics: what was not produced that plainly should exist, which offices were apparently not searched, and what search terms were apparently not used. Agencies must conduct a search reasonably calculated to uncover all relevant documents, and the adequacy of the search is a separate and frequently successful ground.
  • Challenge each exemption individually, addressing the elements.
  • Invoke the foreseeable harm standard expressly and demand that the agency articulate the harm.
  • Demand segregation of factual material.
  • Challenge any Glomar response with evidence of official acknowledgment.
  • Challenge the fee category and any fee determination.
  • Request that the agency exercise discretionary release of information technically exempt but not harmful.

Agencies must decide appeals within 20 business days, with an extension in unusual circumstances. They frequently do not. Partial grants on appeal are common — appealing is worthwhile, and it costs a letter.

Litigation

Where. § 552(a)(4)(B): the district where the complainant resides, where they have their principal place of business, where the records are situated, or the District of Columbia — which has the most developed FOIA case law and is where a large share of these cases are filed.

The complaint is short: jurisdiction, the request, the agency's response or failure, exhaustion, and a demand for production and fees.

The government's answer is due in 30 days, and courts routinely enter a production schedule requiring the agency to process a defined number of pages per month — the Open America framework — rather than ordering immediate production. Negotiating that schedule is the first substantive step and it matters more than the pleadings.

The case is decided on summary judgment, on affidavits rather than testimony. Two things are at issue:

1. Adequacy of the search. The agency must submit a declaration from a person with knowledge describing the search: which systems and offices were searched, what terms were used, why those systems were reasonably likely to contain responsive records, and what was found. The declaration must be nonconclusory and reasonably detailed. Challenges succeed where the declaration is vague, where obviously responsive records were not produced, or where the requester identifies a system that was not searched. The agency need not have found everything — the standard is reasonableness of the search, not completeness of the result.

2. Justification of withholdings. The agency produces a Vaughn index — a document-by-document itemization identifying each withheld record, its date, author, recipients, subject, the exemption claimed, and a justification specific enough to permit adversarial testing. Demand a real Vaughn index; categorical indexes are permitted in large cases but must still be specific enough to evaluate.

In camera review is available in the court's discretion where the index and declarations are inadequate. Courts are reluctant but will do it, particularly for a manageable number of documents.

Discovery is rare and generally limited to the adequacy of the search where the requester makes a showing of bad faith.

Attorney's fees. § 552(a)(4)(E) permits fees to a complainant who has substantially prevailed — defined by the OPEN Government Act to include obtaining relief through a judicial order or an enforceable written agreement, or through a voluntary or unilateral change in position by the agency where the claim was not insubstantial. That last clause restored the catalyst theory, and it matters: an agency that produces everything the day after the complaint is filed may still be liable for fees. Eligibility is followed by an entitlement analysis weighing the public benefit, the requester's commercial interest, the nature of its interest, and whether the agency's withholding had a reasonable basis in law.

Reverse FOIA: when your information is requested

The other side of the problem, and the one most businesses encounter first.

Submitter notice. Executive Order 12600 requires agencies to establish procedures giving notice to submitters of confidential commercial information when a FOIA request seeks it, and an opportunity to object. Most agencies' regulations implement this. Notice may be a short letter with a ten-day response window, so the response capability must exist in advance.

What to do on receiving a submitter notice:

  1. Calendar the deadline immediately and confirm receipt.
  2. Identify precisely what is at issue — obtain the request and the specific documents from the agency.
  3. Object with specificity, document by document and field by field. A blanket objection to an entire submission will be discounted.
  4. Address the Argus Leader elements: that the information is customarily and actually kept private, describing the internal controls that keep it so, and that it was submitted under an assurance of confidentiality, citing the assurance.
  5. Explain the competitive harm anyway. Although Argus Leader removed competitive harm as a required element, agencies still weigh it in exercising discretion, and it strengthens any subsequent litigation.
  6. Address Exemption 3 if a statute independently protects the information.
  7. Propose redactions rather than wholesale withholding. An agency facing a segregability obligation will find a targeted proposal easier to accept.
  8. Ask to be notified before any release and for a defined period to seek judicial relief.

Reverse FOIA litigation. FOIA itself creates no cause of action for a submitter. The route, established in Chrysler Corp. v. Brown, is an APA suit claiming that the agency's decision to release is arbitrary and capricious or contrary to law — often invoking the Trade Secrets Act, 18 U.S.C. § 1905, which prohibits unauthorized disclosure by federal employees of trade secrets and confidential commercial information.

Timing is everything. Seek a temporary restraining order before release, because once the information is public the claim is moot. That means the objection letter must preserve the position and the agency must be asked, in writing, to hold the release pending judicial review.

Prevention. For any business that submits information to a federal agency:

  • Mark every submission with a specific confidentiality legend, identifying the material as confidential commercial information exempt under Exemption 4.
  • Segregate confidential material into separately marked exhibits, so a request produces a clean redaction rather than a fight about the whole document.
  • Obtain an assurance of confidentiality in the submission cover letter, and where a program's regulations provide for confidential treatment, follow the procedure exactly.
  • Maintain it as confidential internally — restricted access, NDAs, and no public disclosure of the same data. Argus Leader's test is about actual practice, and a company that publishes the same figures in a marketing deck has lost the argument.
  • Register a point of contact with the agency for submitter notices, and keep it current. Notices sent to a departed employee's address are the most common way a company loses the opportunity to object.

Related access regimes

The Privacy Act, 5 U.S.C. § 552a, gives individuals a right of access to records about themselves in a system of records, a right to request amendment, and restrictions on disclosure. Requests are often made under both statutes, and the exemptions differ — material exempt under one may be obtainable under the other.

Agency reading rooms. Section 552(a)(2) requires proactive disclosure of final opinions, policy statements, staff manuals, and records released under FOIA that have been or are likely to be the subject of subsequent requests — the "release to one, release to all" principle. Search the reading room before filing a request; the material may already be public.

Other routes to the same information: an agency's public docket in a rulemaking; contract records available through federal procurement databases; inspection and enforcement data many agencies publish; the Congressional Record and hearing materials; and litigation dockets, which frequently contain the agency's own documents filed as exhibits.

State public records laws. Every state has one, and they are frequently faster and broader than FOIA — shorter deadlines, fewer exemptions, and in several states a right to attorney's fees on any successful challenge. For information held by a state agency, a state request is nearly always the better route.

A practical program

For a business that should be requesting records:

  • Identify recurring information needs — competitor submissions, enforcement trends, contract awards, inspection outcomes — and put a small number of standing requests on a calendar.
  • Assign the function to someone who will follow up, because FOIA rewards persistence and punishes nothing else.
  • Use the tracking number and check status on a schedule.
  • Appeal every denial. The cost is a letter and the partial-grant rate is meaningful.
  • Budget for occasional litigation, and note the fee-shifting provision.

For a business that submits information:

  • Build the marking and segregation practice into every submission, before any request arrives.
  • Maintain the point of contact.
  • Have a ten-day response capability — a template objection letter, a designated reviewer, and counsel who can act quickly.
  • Audit what you have submitted to each agency, so that when a notice arrives you know what is at stake.

Closing

FOIA works, imperfectly and slowly. Agencies are under-resourced, backlogs are long, and exemptions are invoked more broadly than the statute contemplates. A requester who expects speed will be disappointed.

But the statute's basic proposition — that any person may demand the government's records without explaining why — remains one of the more remarkable features of American law, and it produces material that no other tool reaches. A well-drafted request, followed by an appeal that engages the exemptions specifically and invokes the foreseeable harm standard, obtains substantially more than most requesters expect. And the fee-shifting provision means that in the cases where litigation is warranted, the cost is often recoverable.

The discipline is unglamorous: describe the records precisely, talk to the FOIA officer, appeal every denial, calendar everything, and be patient. That is the whole method, and it works.

A sample request

Adapt the following. Its virtue is specificity, not elegance.

Re: Freedom of Information Act Request

This is a request under the Freedom of Information Act, 5 U.S.C. § 552.

Records requested. For the period January 1, 2023 through the date of this request, I request the following records concerning the facility operated by [Company] at [address], EPA Facility ID [number]:

  1. All inspection reports, field notes, photographs, and sampling results generated in connection with any inspection of the facility.
  2. All notices of violation, warning letters, and enforcement correspondence sent to or received from the facility.
  3. All complaints received concerning the facility, including the complainant's submission and any intake or referral memoranda, with personal identifiers redacted as necessary.
  4. All communications between the Region [X] enforcement division and headquarters concerning the facility.

Search guidance. I believe responsive records are held by the Region [X] Enforcement and Compliance Assurance Division and by the Office of [X]. Suggested search terms include the facility name, the facility ID, and the street address. Please search email as well as document management systems, including the accounts of [named officials] if identifiable.

Format. Please provide records electronically, in native format with metadata where available.

Segregability. If any record is withheld in whole or in part, please provide all reasonably segregable portions, indicate the amount of information deleted and the exemption claimed at the place of each deletion, and provide an itemization sufficient to permit evaluation of each withholding.

Fees. I am a [category] requester. I agree to pay fees up to $[amount]; please contact me before incurring charges above that amount.

Contact. Please contact me at [phone/email] if any portion of this request is unclear or unduly burdensome; I am glad to discuss narrowing it.

Follow up in three weeks if no acknowledgment arrives, and in six if no determination has issued. A polite call to the FOIA Public Liaison, referencing the tracking number, is more effective than a demand letter and takes five minutes.

Using what you get

Records obtained through FOIA are useful only if they can be used, and two questions arise.

Admissibility. A record produced by an agency is not self-authenticating merely because it arrived in a FOIA envelope. The reliable routes are a certification of authenticity under Federal Rule of Evidence 902(4) for a certified copy of a public record — which agencies will provide on request, sometimes for a fee — or a business records certification under Rule 902(11) where applicable. Request the certification when you request the records; obtaining it later means a second request and another wait. On the hearsay side, Rule 803(8) covers public records setting out the office's activities, matters observed under a legal duty, and, in civil cases, factual findings from a legally authorized investigation — subject to a trustworthiness challenge.

Restrictions on use. There are none. FOIA imposes no confidentiality obligation on a requester, and records lawfully obtained may be used, published, and filed publicly. Where a protective order in separate litigation covers the same material, however, the order governs the party's use of what it received in discovery — and a party that obtains the same document through FOIA should be careful about the argument that it has thereby escaped the order.

Redactions and what they tell you. A production with deletions marked by exemption is itself information: the pattern of Exemption 5 withholdings shows where the deliberation happened, and the volume of Exemption 7(A) withholdings indicates an open enforcement matter. Where 7(A) is invoked, renew the request after the proceeding concludes — the exemption is temporal and the material frequently becomes available.

Referrals and consultations. Agencies commonly refer records originating with another agency to that agency for processing, and consult with others before releasing. Both add months and both are frequently invisible unless you ask. Request that the agency identify any referrals and consultations and provide the tracking information, then follow the record to the second agency yourself.

Timelines, realistically

Expectations calibrate strategy, so here is what actually happens.

Simple request, narrow scope, cooperative agency. Acknowledgment in a week, determination in three to eight weeks, production shortly after. This is achievable and it is what a well-drafted, narrow request produces.

Ordinary request at a busy agency. Acknowledgment in two weeks, placement in a "complex" queue, and a determination in four to twelve months. Follow-up matters here: requesters who check in monthly move faster than those who do not, not because the agency is being punished but because a request with an engaged requester is easier to narrow and close.

Broad request touching enforcement or deliberation. Twelve to thirty-six months, with rolling productions and substantial withholding. Consider whether the request can be split so that the easy material arrives quickly.

After suit is filed. Production schedules commonly run 500 to 1,000 pages per month, so a 20,000-page universe is a two- to three-year case even after a court is involved. Negotiate the schedule with attention to which categories come first, and prioritize by what you actually need.

Expedited processing granted. Weeks rather than months, but grants are uncommon outside genuine urgency and news media requests.

Two planning implications. First, file early — if the records will matter to a decision, a filing, or a comment deadline, work backward and file months ahead. Second, do not build a litigation strategy on a FOIA request unless the schedule permits it; where the material is needed for a pending case, discovery or a subpoena will nearly always be faster, and FOIA is the tool for the case that has not been filed yet.

Primary authority

  • 5 U.S.C. § 552 — FOIA itself: the proactive disclosure duties in § 552(a)(2), the request and response deadlines in § 552(a)(6), the twenty-working-day clock and the unusual-circumstances extension, expedited processing in § 552(a)(6)(E), fees and fee waivers in § 552(a)(4)(A), and de novo judicial review with in camera inspection in § 552(a)(4)(B).
  • 5 U.S.C. § 552(b)(1)–(9) — the nine exemptions, and § 552(a)(8) — the foreseeable harm standard added by the FOIA Improvement Act of 2016, which requires an agency to show that disclosure would actually harm a protected interest.
  • Food Marketing Institute v. Argus Leader Media, 588 U.S. 427 (2019) — Exemption 4 protects information that is customarily and actually treated as private, discarding the older competitive-harm test.
  • Milner v. Department of the Navy, 562 U.S. 562 (2011) — Exemption 2 confined to personnel rules and practices.
  • Department of the Interior v. Klamath Water Users Protective Ass'n, 532 U.S. 1 (2001) — the limits of the Exemption 5 consultant corollary.
  • NLRB v. Sears, Roebuck & Co., 421 U.S. 132 (1975) — deliberative process and the predecisional/postdecisional line.
  • Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir. 1973) — the index an agency must produce to justify withholding.
  • 5 U.S.C. § 552(a)(4)(E) — attorney's fees, including the catalyst theory restored by the 2007 OPEN Government Act.
  • Executive Order 13526 — the classification framework underlying Exemption 1.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Agency FOIA regulations, fee schedules, appeal deadlines, and processing practices differ, and state public records laws vary substantially. Consult qualified counsel before objecting to a release of your own information or filing suit.