FOIA Redaction: Exemptions and Best Practice

By the SladdPDF team · Published August 23, 2026 · Updated August 23, 2026

FOIA redaction is the practice of removing only the information a federal agency may lawfully withhold under one of the Freedom of Information Act's nine exemptions, and releasing everything else. The law does not let an agency hold back a whole document because part of it is sensitive: any reasonably segregable, non-exempt portion still has to be handed over, and each deletion normally has to be marked with the exemption behind it. Done properly, the withheld words are gone from the released file — not merely covered by a black rectangle.

What is FOIA redaction?

FOIA redaction is the deletion of exempt material from a record before it is released to a requester under 5 U.S.C. § 552. It sits between two duties that pull in opposite directions: the agency has to protect the narrow categories Congress carved out, and it has to disclose everything else. Redaction is how both duties are satisfied on the same page.

Agency staff and requesters read the same release differently. Staff see a processing decision: which exemption applies, how far it reaches, and whether it can be defended in court. Requesters see a black bar and a code. Both need the same three mechanics — the exemption list, the segregability rule, and whether the hidden text is really gone.

What are the nine FOIA exemptions?

The Freedom of Information Act contains nine exemptions, numbered (b)(1) through (b)(9) after the subsection of the statute that creates them. The Justice Department's Office of Information Policy publishes them as a plain-language list, summarized below.

Exemption 7 is the one you will see broken down further on a release, because it is lettered (b)(7)(A) through (b)(7)(F). It applies to records compiled for law enforcement purposes to the extent that release could reasonably be expected to interfere with enforcement proceedings, would deprive a person of the right to a fair trial or an impartial adjudication, or could reasonably be expected to constitute an unwarranted invasion of personal privacy. Further subsections cover disclosure of techniques and procedures for law enforcement investigations or prosecutions, and information whose release could reasonably be expected to endanger the life or physical safety of any individual.

Two points are easy to miss. First, the 1986 amendments removed the requirement that Exemption 7 records be "investigatory," so law enforcement manuals and other non-investigatory material can fall inside it. Second, meeting the terms of an exemption is not by itself enough. The FOIA Improvement Act of 2016 codified a foreseeable harm standard: agencies shall withhold only if the agency reasonably foresees that disclosure would harm an interest protected by an exemption, or disclosure is prohibited by law. Where the likelihood of significant harm is low and the public interest is high, DOJ guidance encourages agencies to make a discretionary release anyway.

How do agencies mark exemption codes on a redacted page?

The code printed on or beside a black bar tells you which exemption the agency relied on for that deletion, and FOIA requires it. The statute provides that the amount of information deleted, and the exemption under which the deletion is made, shall be indicated on the released portion of the record — unless including that indication would itself harm the interest the exemption protects.

In practice that produces the conventions every FOIA requester recognizes: a black box with "(b)(6)" or "(b)(7)(C)" stamped inside it or in the margin, boxes sized to the withheld text so the extent of the deletion is visible, and full-page placeholders reading "Withheld in full" with the exemptions listed.

What does the "reasonably segregable" duty require?

It requires the agency to release the non-exempt parts of a record even when other parts are properly withheld. The statutory text is direct: "Any reasonably segregable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt under this subsection." DOJ's Office of Information Policy calls this a fundamental tenet of the Act.

The duty has teeth in litigation. Agencies carry the burden of demonstrating that no reasonably segregable information exists within the records they withhold, and district courts have an obligation to make specific findings on segregability when they rule for an agency — a failure to do so can be reversible error. That is why a blanket "withheld in full" response invites an appeal: the agency has to be able to explain why nothing on the page could be separated out.

For processing staff, segregability is a line-by-line exercise, not a document-by-document one. A memo containing one exempt deliberative paragraph is released with that paragraph blacked out and the rest intact. The goal is the smallest deletion that still protects the interest.

Why do agencies rasterize or print and rescan a release?

Because a black rectangle in a PDF is a drawing placed on top of the page, and the text underneath it usually survives. Anyone who opens the file can select the covered area, copy it, and paste the "hidden" words into a text editor. The visual redaction holds; the file does not.

Rasterizing solves this by flattening each finished page into a single image. Once a page is an image, there is no text layer, no annotation objects and no hidden content left under the black areas — there is nothing to select. Printing a release and rescanning it achieves the same thing physically — which is why FOIA reading rooms are full of documents that look like photocopies of photocopies. Crude, but verifiably safe.

The trade-off is real. Flattened releases are not searchable, screen readers cannot read them, and journalists lose the ability to run text analysis across thousands of pages. The usual compromise is to flatten first and then OCR the result, which rebuilds a searchable text layer from what is visible on the page. For the mechanics, see our explainer on why rasterization is the gold standard of PDF redaction.

What can a requester do when the redactions look excessive?

File an administrative appeal — agencies must give you at least 90 days from the date of an adverse determination, and redactions are an adverse determination. An adverse determination covers any response where the record is exempt in whole or in part, cannot be located or does not exist, is not reproducible in the format you asked for, or where fees or expedited processing were denied.

Work through it in order:

1. Read the codes. Map each black bar to its exemption. A page dense with (b)(5) deliberative-process markings raises different questions than one marked (b)(7)(C).
2. Test segregability. Ask whether whole paragraphs, headings or attachments were withheld where only a name or a sentence needed protecting.
3. Check the response letter. Under the FOIA Improvement Act of 2016, an adverse determination has to state the reasons for the denial, your right to an administrative appeal within no fewer than 90 days, and your right to seek dispute resolution services from the agency's FOIA Public Liaison or from the Office of Government Information Services.
4. Call the FOIA Public Liaison first. Many over-broad redactions are processing errors that a conversation fixes faster than a formal appeal.
5. Appeal in writing. Name the tracking number, identify the specific withholdings you contest, and argue segregability and foreseeable harm — not just that you want the material. Absent unusual circumstances, agencies should decide an appeal within 20 working days.

Exhausting the administrative appeal also preserves your options: it normally has to come before a FOIA lawsuit in federal district court.

What do federal redaction failures teach?

Every well-known federal redaction failure has the same root cause: the black mark was cosmetic, and the text under it was never removed. The pattern repeats across two decades and every kind of institution.

• Justice Department diversity report (2003). Roughly half of a 186-page internal report on diversity among DOJ attorneys was blacked out under a FOIA deliberative-process exemption. It had been sanitized in Microsoft Word using the highlight tool set to black, then published as PDF; the text layer stayed intact and was copied out with free Acrobat Reader.
• Pentagon report on the death of Nicola Calipari (2005). The classified portions of the investigation into the checkpoint shooting of the Italian intelligence officer — soldiers' names, unit numbers and operational details — were recovered by a select-all copy-paste. The file was pulled, but the unredacted version had already spread. The NSA subsequently issued formal guidance on redacting Word and PDF documents.
• TSA screening manual (2009). A screening standard operating procedure posted to a federal contracting site had a black box drawn on top of the sensitive text rather than the text removed, exposing special screening rules for diplomats and officials and images of sample credentials. TSA acknowledged the document had been improperly posted; mirrors of it remain online.
• Ghislaine Maxwell deposition (2020). Here the black bars held. The court release still included the stenographer's alphabetized index at the back of the transcript, listing every word with page and line references — enough for journalists to reconstruct redacted names within a day.
• Manafort court filing (2019). Defense counsel filed a document whose redaction bars were drawn over unflattened text; reporters read the hidden passages within minutes.

The lessons generalize. Deletion must be real, not visual. Indexes, bookmarks, comments, embedded attachments and metadata are derived text that can leak what the body redacts — and, as the Maxwell case shows, a technically perfect redaction can still be defeated by a structural feature of the same document. We cover more of these episodes in our roundup of famous redaction failures.

FOIA redaction best practice: a working checklist

Good FOIA redaction is a workflow, not a single click. The following sequence reflects what the failures above would have prevented.

1. Work from a clean copy. Redact a duplicate, keep the unmodified original in the case file, and never overwrite the source record.
2. Decide before you draw. Identify the exemption for each passage and record it. The code has to go on the page anyway.
3. Segregate line by line. Withhold the sentence, not the section, unless you can explain why the whole section is exempt.
4. Apply the foreseeable harm test. Ask what specific harm release would cause to the interest the exemption protects, and consider a discretionary release when the answer is thin.
5. Remove, then flatten. Apply the redactions and flatten each page to an image so that no text survives beneath them.
6. Sweep the hidden layers. Strip document metadata, comments, tracked changes, bookmarks and embedded files, and check indexes and appendices for the same information you just removed. Our guide to redacting a PDF step by step covers the mechanics.
7. Run the copy-paste test. Open the finished file, select all, copy, and paste into a text editor. If any withheld word appears, start again.
8. Log the release. Record which exemptions were applied to which pages, so the response letter and any appeal response can be defended.

Doing it in the browser

Requesters, journalists and small offices often need to redact or verify a single document without sending it anywhere. SladdPDF is a free tool that redacts a PDF entirely in your browser: the file is processed locally with JavaScript and WebAssembly and is never uploaded to any server. Its Secure mode rasterizes every page after redaction, so the underlying text, layers and hidden objects are destroyed rather than covered, and metadata can be stripped on export.

Two honest limits. The free version exports at standard resolution; print-quality 300 DPI export needs the paid Pro key — the page count, though, is unlimited. And SladdPDF is a document tool, not a FOIA case-management system — it does not stamp exemption codes, track a request or produce a processing log. Agencies running high-volume production releases will want their existing redaction platform for that; SladdPDF suits the one-off document, the sensitive attachment and the verification pass.

This article is general guidance, not legal advice.