FOIA Exceptions: What Agencies Can Withhold—and Why

Updated: October 22, 2026

FOIA exceptions let federal agencies withhold records that fall within nine statutory categories, including classified information, personal privacy, and certain law-enforcement material. Agencies must identify the exemption they rely on, and some records may be released with protected portions redacted.

These exceptions balance public access with interests Congress has chosen to protect. Understanding them helps explain why a request may produce a full release, a partial response, or a denial—and what an agency’s explanation means for the records still withheld.

• first 100 pages duplication usually not charged for under FOIA.gov guidance

What are FOIA exceptions, and what do they protect?

FOIA exceptions are nine statutory exemptions that let federal agencies withhold defined categories of information; they do not make every agency record automatically secret. The exemptions include classified national security information under Exemption 1 and information another federal law bars from disclosure under Exemption 3.

The exemptions address different risks and records. Exemption 4 covers confidential or privileged commercial information, while Exemption 6 protects personal privacy. Exemption 7 applies to specified law-enforcement records, Exemption 8 to certain financial-institution records, and Exemption 9 to geological information, such as well data.

Fees and access

FOIA’s exemptions concern whether information may be withheld; request fees are a separate matter. FOIA.gov says there is usually no charge for the first two hours of search time or for the first 100 pages of duplication.

How do the nine exemptions differ in practice?

The nine FOIA exemptions differ by the kind of harm or protected interest disclosure could affect: some cover agency operations, others commercial information, privacy, law enforcement, or regulated industries. The exemption that matters depends on what a record contains and why releasing it could cause a protected harm.

• Exemption 2 covers internal agency personnel rules and practices; it concerns how an agency manages its own internal operations.
• Exemption 4 may apply to trade secrets or confidential or privileged commercial or financial information in a record.
• Exemption 5 covers privileged communications within or between agencies, distinguishing protected government deliberations from commercial information.
• Exemption 7 concerns law-enforcement information when disclosure could interfere with enforcement proceedings.
• Exemption 8 covers financial institution examination reports.
• Exemption 9 protects geological and geophysical information and data, including maps concerning wells.

These categories are not interchangeable: a commercial record points to a different exemption than an agency communication or a law-enforcement file. The practical question is whether the specific material fits the exemption’s subject and, where relevant, whether disclosure could cause the harm the exemption addresses.

What should you check when an agency withholds a record?

When an agency withholds a record, check which FOIA exemption it invokes and whether the information described in its explanation fits that exemption’s category. FOIA has nine exemptions, covering areas such as classified national security information, personal privacy, and certain law-enforcement records. The category matters: an agency’s label alone does not explain why the particular information in your request may be withheld.

Check what can still be released

A record may contain both protected and nonprotected material, so distinguish the sensitive passage from the rest of the document. Ask the agency to release portions that do not fall within the exemption it claims, rather than treating the entire record as necessarily protected.

Keep the agency’s response with your request and all related correspondence. Together, these documents help you identify the specific withholding when you ask for assistance or challenge the decision. Courts enforce FOIA and can order an agency to release records it improperly withheld from a requester.

What can you do if an exemption is claimed?

If an agency claims a FOIA exemption, contact its FOIA Requester Service Center to ask about your request’s status and what steps may help move it along. The center can address questions about the request and ways to seek a quicker response; under certain conditions, you may qualify for expedited processing.

Check fees and seek guidance

FOIA.gov says there is usually no charge for the first two hours of search time or for the first 100 pages of duplication. If the agency anticipates fees, ask the FOIA Requester Service Center to explain the likely costs and any options relevant to your request.

The Department of Justice’s Office of Information Policy and the Office of Government Information Services are among the bodies involved in FOIA guidance. These resources can help you understand the process, but an exemption claim is addressed through the agency handling your request: ask what information was withheld and what review or appeal steps are available.

What records and agencies does FOIA cover?

FOIA covers records held by federal agencies, including electronic records, but it does not cover records held by Congress, federal courts, state and local governments, private businesses, schools, private organizations, or private individuals. The Electronic Freedom of Information Act Amendments of 1996 expanded FOIA to cover electronic records and make them more easily and widely available to the public.

When FOIA is not the right route

FOIA applies to federal agencies, not every institution that performs public work or holds information of public interest. A record’s subject matter does not bring it under FOIA if the record is held by an institution outside the federal agency system.

For a record held outside a federal agency, first identify the institution that maintains it, then check that institution’s own access process. For example, a request for a state government record should be directed through the relevant state’s process; a FOIA exemption is not the issue when FOIA does not govern the record.

When does an exemption-based request strategy fail?

An exemption-based request strategy fails when it treats a possible withholding ground as proof that FOIA applies or as a reason to withhold an entire record. FOIA concerns identifiable records held by federal agencies; an exemption does not bring records held by Congress, a court or a private business within the statute.

Match the request to the record and the exemption

A request that says only “privacy” gives the agency too little to assess: the request should identify the record sought, while any privacy-based withholding must rest on the specific exemption and the information it protects. FOIA’s exemptions address distinct categories, including personal privacy under Exemption 6 and law-enforcement information under Exemption 7; a broad label cannot replace that distinction.

An exemption also does not automatically justify withholding every page. The relevant question is whether protected material can be separated from the rest, so a request strategy should preserve the possibility of releasing nonexempt portions. Exclusions are a separate part of FOIA’s framework, not another name for exemptions: treating the terms as interchangeable can obscure which rule an agency is applying and what kind of record is at issue.

Frequently asked questions

Key takeaways

• FOIA has nine exemptions, each aimed at a defined category of information.
• Ask which exemption applies and whether non-protected portions can be released.
• FOIA does not cover records held by Congress, federal courts, state and local governments or private entities.
• FOIA.gov says the first two hours of search time or first 100 pages of duplication are usually free.