What FOIA's Nine Exemptions Actually Let an Agency Withhold

A FOIA exemption is permission to withhold, not an instruction to withhold. All nine categories listed on FOIA.gov are discretionary, and since the FOIA Improvement Act of 2016 a federal agency may apply one only when it reasonably foresees that disclosure would harm the interest that exemption protects. For a reporter, that gap between "could be withheld" and "must be withheld" is where most of the work happens.

The scale is worth keeping in mind before you file. The Justice Department's Office of Information Policy reported in July 2026 that federal agencies received 1,707,197 FOIA requests in fiscal year 2025, a 13.7% increase over the previous year, and processed 1,635,055 of them. Your request joins a queue measured in the millions. Precision is not a courtesy to the agency; it is the thing that gets you records.

What do the nine exemptions actually cover?

They cover nine defined categories of information, not nine categories of document. That distinction matters more than anything else here: exemptions attach to information inside a record, which is why partial releases are normal rather than a fudge. The Justice Department's FOIA Reference Guide notes that where a page is withheld in part, "the withheld portions of the page will ordinarily be specifically marked with the applicable exemptions."

The wording below is as FOIA.gov states it. Read it as a checklist for anticipating redactions, not as legal advice — a question about a specific withholding belongs with a lawyer who handles records litigation.

Exemption	What FOIA.gov says it covers	Detail from the source
1	"Information that is classified to protect national security"	Turns on classification, not on sensitivity in general
2	"Information related solely to the internal personnel rules and practices of an agency"	The word "solely" is part of the published description
3	"Information that is prohibited from disclosure by another federal law"	The bar comes from a separate statute, not from FOIA itself
4	"Trade secrets or commercial or financial information that is confidential or privileged"	Commonly reached in contractor and grant records
5	"Privileged communications within or between agencies"	DOJ lists deliberative process, attorney work product, attorney-client and presidential communications privileges
6	"Information that, if disclosed, would invade another individual's personal privacy"	Typically names, contact details and personnel information
7	Information compiled for law enforcement purposes	DOJ describes six sub-categories, 7(A) through 7(F)
8	"Information that concerns the supervision of financial institutions"	Bank supervision and examination material
9	"Geological information on wells"	The narrowest of the nine

FOIA.gov separately describes three statutory exclusions covering certain law enforcement and national security records, and states that "records falling within an exclusion are not subject to the requirements of the FOIA." Exclusions are not exemptions, and they work differently in practice.

Why does the foreseeable harm standard change how you write a request?

Because it moves the argument from category to consequence. Office of Information Policy guidance, updated 4 September 2024, states that agencies may withhold only where "the agency reasonably foresees that disclosure would harm an interest protected by one of the nine exemptions that FOIA enumerates" — a standard the FOIA Improvement Act of 2016 codified at 5 U.S.C. § 552(a)(8)(A)(i).

The same guidance tells agencies to articulate "both the nature of the harm [from release] and the link between the specified harm and specific information," rather than rest on what it calls a "boilerplate" assumption. It also asks agencies to confirm in response letters that they considered the standard, and encourages discretionary release where withholding would be permissible but unnecessary.

Practically, that gives you two things to do. Ask, in the request itself, for any segregable non-exempt portions and for discretionary release consideration. Then read the response letter for whether a foreseeable-harm analysis is actually stated or merely gestured at — the guidance asks for the former, and a letter that skips it is a specific, documentable point to raise on appeal rather than a vague complaint about stonewalling.

What deadlines and fee treatment apply to a news request?

Twenty business days is the baseline. The DOJ Reference Guide states that "all federal agencies are required to respond to a FOIA request within twenty business days, excluding Saturdays, Sundays, and legal holidays," and that agencies may extend that clock in unusual circumstances — when records sit in separate offices, when the volume is voluminous enough to require compilation and review, or when another agency must be consulted.

Fees are the part newsrooms most often leave on the table. The guide identifies a category covering "educational or noncommercial scientific institutions and representatives of the news media, who are charged only for duplication fees, and who are provided the first one hundred requested pages free of charge." If you are filing as a journalist, say so explicitly and explain why you qualify; the category is not applied automatically because your signature block says reporter.

Two more mechanics belong in your template. Expedited processing is available on stated grounds, including where "the lack of expedited treatment could reasonably be expected to pose a threat to someone's life or physical safety." And an administrative appeal, per the same guide, must be postmarked or transmitted "within 90 calendar days after the date of the component's response" to be considered timely — a deadline that quietly ends more stories than any exemption does.

What should you do when the agency goes quiet?

Escalate in order, and keep the paper trail. The steps below follow routes the agencies themselves publish; none of them requires a lawyer, and each produces a document you can cite later.

1. Log the acknowledgement and tracking number, and calendar the twenty-business-day date using the guide's definition of business days, not the day you hit send.
2. Contact the agency's FOIA Public Liaison in writing about status or scope before you assume bad faith; narrowing a request often moves it out of a complex queue.
3. File an administrative appeal inside the 90-day window. FOIA.gov describes appealing as simple — "typically, all you need to do is send a letter or e-mail to the designated appeal authority" — with "no fee or cost involved."
4. Take an unresolved dispute to the Office of Government Information Services at the National Archives, which describes itself as the federal FOIA Ombuds and offers mediation and dispute resolution between requesters and agencies.
5. Only then weigh litigation, and weigh it with counsel. That is an editorial and legal decision, not a workflow step.

What this framework does not settle

It does not tell you whether a particular redaction is lawful. The published guidance sets out what agencies are instructed to do; whether a given agency did it correctly in a given case is contested ground, worked out by appeal officers and courts, and nothing here substitutes for advice from a records lawyer.

It also says nothing about state public-records laws, which carry their own exemptions, deadlines and appeal routes, or about the many public-interest stories that never touch a federal record at all. What transfers is the habit: treat every exemption as a claim that has to be justified against a named harm, and hold the agency to the standard its own guidance publishes.

For a related business news perspective, read How NewsMatch Actually Multiplies Newsroom Donations.