Freedom of Information Act (FOIA)
The Freedom of Information Act (FOIA, 1966) — codified at 5 U.S.C. § 552 — gives any person (not just U.S. citizens — corporations, foreign nationals, and journalists all qualify) the right to request records from federal executive branch agencies. Agencies must respond within 20 business days — a deadline routinely missed; backlogs of months to years are common at high-demand agencies like the FBI, State Department, and DOD. FOIA requests that are denied or ignored can be appealed within the agency, then challenged in federal district court, where judges review the agency's withholding decision. Nine statutory exemptions allow agencies to withhold certain records: (1) classified national security information; (2) internal personnel rules; (3) records exempt under other statutes; (4) trade secrets and confidential commercial information; (5) inter-agency deliberative process privilege (the most controversial — used to protect draft decisions and policy discussions); (6) personal privacy; (7) law enforcement records that could harm proceedings; (8) financial institution examination records; and (9) geological data. Exemptions 5, 6, and 7 generate the most litigation. Fee waivers are available for news media, educational institutions, and noncommercial scientific institutions. FOIA does not apply to Congress, the courts, or the President's immediate office (the EOP staff — distinct from agencies). The OPEN Government Act (2007) and FOIA Improvement Act (2016) strengthened the law — including a "foreseeable harm" standard for withholding (agencies must show specific harm, not just technical applicability of an exemption).
Current Law (2026)
| Parameter | Value |
|---|---|
| Governing law | Freedom of Information Act, 5 U.S.C. § 552 |
| Applies to | All federal executive branch agencies |
| Response deadline | 20 business days (extendable for unusual circumstances) |
| Fee categories | Commercial, educational/scientific, news media, all other |
| Fee waivers | Available when disclosure serves the public interest |
| Exemptions | 9 statutory exemptions (national security, privacy, law enforcement, etc.) |
| Appeal | Administrative appeal required before filing lawsuit |
| Attorney's fees | Available to requesters who substantially prevail in court |
Legal Authority
- 5 U.S.C. § 552 — Public information; FOIA (mandatory disclosure of agency records upon request; 9 exemptions; fee structure; judicial review)
- 5 U.S.C. § 552a — Privacy Act (protects personal records maintained by federal agencies; individual access and correction rights; limits on disclosure)
- 5 U.S.C. § 552b — Government in the Sunshine Act (multi-member agency meetings must be open to the public; 10 exemptions)
- 5 U.S.C. § 553 — Rulemaking (notice-and-comment procedure for federal regulations; Federal Register publication)
Implementing Regulations
- 5 CFR Part 2004 (OGIS) — Office of Government Information Services: FOIA ombudsman mediating disputes between requesters and agencies
- Each federal agency issues its own FOIA regulations (e.g., 28 CFR Part 16 — DOJ FOIA; 32 CFR Part 286 — DOD FOIA) specifying: designated FOIA offices, fee schedules, expedited processing criteria, administrative appeal procedures, and Vaughn index requirements for withholdings
- 6 CFR Part 5 — Department of Homeland Security FOIA and Privacy Act (36 sections — DHS rules governing public records requests and Privacy Act access for one of the largest and most frequently queried federal agencies, covering CBP, ICE, TSA, USCIS, Secret Service, and other DHS components):
- Dual processing (§ 5.10): when a request involves records about the requester, DHS processes it simultaneously under both FOIA and the Privacy Act to give the requester the maximum access available under either law — whichever provides broader access governs the response
- Fee structure (§ 5.11): DHS fees mirror the standard four-category FOIA framework — commercial requesters pay search, review, and duplication; educational/scientific institutions and news media pay only duplication; all others get 2 free hours of search plus 100 free pages; fee waiver requires showing that disclosure contributes significantly to public understanding of government operations and is not primarily in the requester's commercial interest
- CBP business confidentiality (§ 5.12): records submitted to U.S. Customs and Border Protection (CBP) that contain trade secrets or confidential commercial/financial information receive heightened protection — CBP notifies submitters before disclosure and applies the deliberative process and commercial privilege exemptions broadly to protect import/export business data
- Privacy Act requests (§§ 5.21–5.25): individuals seeking records about themselves must submit a written request to the specific DHS component holding the records; DHS acknowledges requests within 10 business days; classified records are processed under special handling; administrative appeals of Privacy Act denials must be filed within 90 days of the denial letter
- Amendment requests (§ 5.26): individuals may request correction of inaccurate, irrelevant, or incomplete records in DHS systems of records; requests must be in writing to the component's Privacy Act Officer and must specify exactly what should be changed and why; DHS components must acknowledge amendment requests within 10 business days
- Accounting of disclosures (§ 5.27): individuals may request a written accounting of all disclosures DHS has made of their records to third parties (other than intra-agency or law enforcement disclosures); this right lets individuals track who has seen their records and serves as a check on unauthorized sharing
- Contractor obligations (§ 5.32): any DHS contractor operating a system of records on behalf of DHS must incorporate standard GSA Privacy Act contract clauses — the contractor is treated as an agency employee for Privacy Act violation purposes, exposing individuals to civil and criminal penalties for unauthorized disclosures
- DOJ Office of Information Policy — issues government-wide FOIA guidance; publishes annual FOIA statistics by agency; administers FOIA.gov portal
- Exec. Order 13526 — Classified national security information: establishes the classification/declassification framework that governs FOIA Exemption 1 withholdings
- 21 CFR Part 20 — FDA Public Information (75 sections): FDA's implementing rules for FOIA, specifying exactly which categories of records are and are not available for public disclosure — the most practically important of any agency-specific FOIA rule because FDA holds vast amounts of proprietary pharmaceutical, device, and food manufacturer data:
- § 20.101 — Administrative enforcement records: FDA inspection records — including Forms FD-483 (factory inspection observation lists) and FD-2275 — are available for public disclosure at the time they are first disclosed to the company being inspected; regulatory letters, recall and detention requests, and notices of import refusal are similarly public once issued; establishment inspection reports are treated as investigatory records and handled more restrictively until final action
- § 20.117 — New drug information: FDA maintains publicly available computer listings of every NDA and ANDA (abbreviated new drug application) approved since 1938 — trade name, applicant, approval date, and withdrawal date if applicable; this makes the approval history of every marketed drug a public record; the underlying clinical trial data and manufacturing formulations in the application file are separately handled under trade secret protections
- § 20.61 — Trade secrets exemption (Subpart D): manufacturing processes, chemical formulations, clinical trial protocols and data submitted by drug/device/food manufacturers are protected from FOIA disclosure as trade secrets and confidential commercial information; FDA must make this determination record-by-record and must disclose any non-exempt segregable portions; submitters who fear their confidential data will be released may file a reverse-FOIA suit to block disclosure
- § 20.112 — Voluntary drug experience reports: MedWatch adverse event reports submitted voluntarily by physicians and hospitals (FDA Form 3500) are released only with written consent of both the reporter and the subject individual; mandatory adverse event reports from manufacturers are handled under different rules at 21 CFR Part 310
- § 20.110 — FDA employee information: name, title, grade, position description, salary, work address, and work telephone number for every FDA employee are public; home address and home telephone number are not
- What researchers actually FOIA from FDA: Form 483 inspection records (to assess manufacturing quality at drug/food facilities before investing or buying products), NDA safety reports once post-market safety concerns arise, advisory committee correspondence, and pre-submission meeting minutes; journalist and advocacy group requests for FDA-industry meeting records (covered by § 20.108 — agreements with other organizations) have increased significantly since 2015
How It Works
FOIA is the law that gives the public the right to request access to records from any federal executive branch agency. Enacted in 1966, it operates on the presumption that government information belongs to the people — agencies must disclose records unless one of nine specific exemptions applies.
FOIA operates on a simple premise: any person — U.S. citizen or not, individual or corporation — can file a written request with any federal executive agency for records it holds, without explaining why. Agencies must respond within 20 business days, though backlogs at popular agencies (FBI, DHS, State Department) routinely stretch responses to months or years. Nine statutory exemptions permit withholding: (1) classified national security information; (2) internal agency personnel rules; (3) information exempt under other statutes; (4) trade secrets and confidential commercial information; (5) inter-agency deliberative process privileged memoranda; (6) personal privacy (personnel, medical files); (7) law enforcement records that could cause specified harms; (8) financial institution examination reports; and (9) geological well data. Exemptions are discretionary — agencies can release exempt material — and must disclose any reasonably segregable non-exempt portions of otherwise withheld records. Fees depend on requester category: commercial requesters pay for search, review, and duplication; educational/scientific institutions and news media pay only for duplication; all others get the first two hours of search and 100 pages free.
Two companion statutes complete the transparency framework. The Privacy Act (5 U.S.C. § 552a) — unlike FOIA, limited to U.S. citizens and lawful permanent residents — gives individuals the right to access and correct their own records maintained by federal agencies, and restricts how agencies collect, maintain, use, and disclose personal information; filing a request under both FOIA and the Privacy Act simultaneously maximizes what you receive. The Administrative Procedure Act (5 U.S.C. § 553) requires agencies to publish proposed rules in the Federal Register and accept public comments before finalizing regulations — the "notice-and-comment" process that ensures public participation in rulemaking. The FOIA Improvement Act of 2016 strengthened disclosure by codifying a "foreseeable harm" standard: agencies must show that disclosure would cause specific identifiable harm before invoking an exemption, not merely that information technically falls within one.
How It Affects You
If you want to request government records: Anyone can file a FOIA request with any federal executive agency — no explanation required, no citizenship requirement. Before sending a request, check the agency's FOIA Reading Room (every agency must maintain one under § 552(a)(2)) — frequently requested records are often already posted there. If the record isn't in the reading room, submit your request in writing to the agency's designated FOIA office. Most agencies now have online portals (FOIA.gov has a centralized portal for many agencies, or go directly to the agency website). Be specific: a vague request for "all records about Topic X" generates delays and vague responses. A targeted request — naming specific date ranges, program names, document types, officials involved — moves faster. Include your contact information and state the fee category you believe you fall into (most individual requesters get the first 2 hours of search time and 100 pages free). The agency has 20 business days to respond — though most high-volume agencies (FBI, DHS, State) routinely take months to years. If you need records urgently, request expedited processing in your letter by explaining "urgency to inform the public about federal government activity" or imminent threat to life/safety — agencies must respond to expedited processing requests within 10 calendar days.
If your FOIA request is delayed or denied: Inaction is technically a denial you can appeal. After the 20-business-day deadline passes with no substantive response, you can file an administrative appeal citing constructive denial — this often prompts faster movement. If the agency explicitly denies your request (citing exemptions), you have the right to appeal to the agency head within the time specified in the denial letter (usually 90 days). The appeal is free. Many denials are overturned on appeal when the requester explains why an exemption doesn't apply or proposes the agency release non-exempt portions. If the agency appeal fails, you can sue in federal district court — the judge reviews withholding decisions de novo (fresh, not just for abuse of discretion), meaning the agency must justify every redaction. If you substantially prevail in court, the agency must pay your attorney's fees and litigation costs. For complex disputes, the Office of Government Information Services (OGIS) at NARA offers free mediation between requesters and agencies — often more practical than litigation.
If you're a journalist, researcher, or nonprofit: Your requester category affects fees significantly. News media requesters (including freelancers with a track record of publication) pay only for duplication — search and review are free — and are entitled to fee waivers when "disclosure is likely to contribute significantly to public understanding of government operations." Educational/scientific institutions pay only duplication fees. Fee waiver requests must explain what public benefit the disclosure serves. Expedited processing is also available to media requesters when there's urgent public need. The FOIA Improvement Act of 2016 codified a "foreseeable harm" standard — agencies must show that disclosure would cause specific identifiable harm before withholding under Exemptions 5 (deliberative process) or others — strengthening your case if an agency invokes boilerplate exemption language.
If you're trying to obtain records about yourself: FOIA and the Privacy Act work in tandem. File your request under both statutes to maximize what you receive — state explicitly that you are requesting access under both 5 U.S.C. § 552 and 5 U.S.C. § 552a. Under FOIA alone, agencies can invoke privacy exemptions (Exemption 6) to withhold your own records when requested by third parties — but your Privacy Act rights give you access to your own records directly. For records about yourself held by the FBI, DHS, or law enforcement agencies, expect significant redactions under Exemption 7 (law enforcement) — appeal if the agency applies exemptions broadly without specific harm justification. If you're challenging government action that affected you (denial of a benefit, enforcement action, security clearance revocation), obtaining the underlying agency records through FOIA/Privacy Act is often a critical first step.
If you want to participate in agency rulemaking (related APA right): When an agency proposes a regulation, the APA (5 U.S.C. § 553) requires a public comment period — typically 30–60 days, announced in the Federal Register and at Regulations.gov. Anyone can submit a comment; there's no credential requirement. Comments become part of the official administrative record the agency must consider and respond to when it finalizes the rule. A substantive comment that identifies factual errors, identifies affected parties the agency didn't consider, or proposes alternatives can materially influence the final rule — and failure to respond to significant comments is grounds for a court to vacate the rule. Subscribe to agency notification systems at Regulations.gov to track rules in your area of interest.
State Variations
FOIA applies only to federal agencies. Every state has its own public records law (often called "sunshine laws" or "open records acts") with different exemptions, timelines, and fee structures. Some states are more open than others — Texas and Florida have particularly broad public access laws; some states have more restrictive exemptions for law enforcement and personnel records.
Pending Legislation
- HR 7508 — Financial Disclosure Modernization Act: creates tiered reporting thresholds for large financial holdings. Status: Introduced.
- S 3827 — Financial Disclosure Modernization Act (Senate companion). Status: Introduced.
Recent Developments
FOIA request volumes have grown steadily, with federal agencies receiving over 900,000 requests annually. Agency backlogs remain a persistent problem, particularly at DHS, DOJ, and the State Department. Inspectors General often rely on FOIA-adjacent authorities to access agency records for oversight. The FOIA Improvement Act of 2016 codified a "presumption of openness" and required agencies to proactively disclose records that have been requested three or more times. Technology modernization — including AI-assisted document review and improved online portals — has been a focus of recent reform efforts.
- In March 2026, the Defense Nuclear Facilities Safety Board finalized amendments to its FOIA regulations after receiving no public comments on its November 2025 proposed rule.
- DOGE and FOIA opacity (2025): DOGE's operations across federal agencies have prompted a surge of FOIA requests from journalists, nonprofits, and congressional offices seeking records of agency access, staffing decisions, and data system activity. Agencies have responded with lengthy processing delays, broad Exemption 5 (deliberative process privilege) withholding claims, and disputes over whether DOGE "records" constitute agency records subject to FOIA. Courts have begun ordering DOGE-related disclosures; the litigation is among the most active FOIA enforcement in decades.
- Exemption 6/7 and immigration enforcement records: DHS FOIA backlogs reached record levels in 2025 as requests for ICE enforcement records, immigration court data, and detention facility inspections surged. DHS invoked personal privacy (Exemption 6) and law enforcement (Exemption 7) exemptions broadly. Several federal courts issued orders compelling DHS to accelerate production or narrow withholding claims. FOIA has become a primary transparency mechanism for oversight of immigration enforcement operations.
- Presidential records and FOIA gap: Presidential and Vice Presidential records are governed by the Presidential Records Act (PRA), not FOIA — they cannot be requested under FOIA during or after an administration until released under PRA's own schedule. The Trump administration's use of Signal (a disappearing-message app) for official communications — exemplified by the "Signalgate" episode involving National Security Advisor Waltz — raised concerns about PRA compliance and whether those communications would ever be subject to any public disclosure.
- AI and FOIA processing: Multiple agencies are piloting AI-assisted FOIA review to address backlogs — using machine learning to identify responsive documents, apply exemptions, and redact personal information. NARA and DOJ OIPP issued guidance on acceptable AI use in FOIA processing. Privacy advocates have raised concerns about AI over-redaction and the difficulty of appealing AI-generated withholding decisions.