Freedom of Information Act (FOIA) & Government Transparency

FOIA applies only to records held by federal executive branch agencies and independent regulatory agencies, roughly 100 departments and agencies government-wide. It does not apply to Congress, the federal courts, or state and local governments, each of which operates under its own separate access rules discussed in the Beyond FOIA tab. It also does not reach purely private companies or individuals, even when they do business with the federal government, unless a contractor is holding records on an agency's behalf.

The law's reach inside the executive branch has real limits as well. Courts have held in cases including Kissinger v. Reporters Committee for Freedom of the Press (1980) that units within the Executive Office of the President whose sole function is advising and assisting the President personally, such as the National Security Council staff in most contexts, fall outside FOIA's definition of an "agency," while components with substantial independent regulatory or spending authority generally remain covered.

FOIA defines "agency" to include executive departments, military departments, government corporations, government-controlled corporations, and independent regulatory agencies. Government contractors are not agencies, but records a contractor creates or holds for an agency, and that the agency controls, can be reachable through a request to the agency itself.

The White House Office, the National Security Council staff, and the Office of the Vice President are generally outside FOIA under Kissinger and later rulings, while the Office of Management and Budget, the U.S. Trade Representative, and the Council on Environmental Quality are covered because they exercise substantial independent authority.

Any person, a citizen, a permanent resident, a foreign national, a journalist, a corporation, or an advocacy group, can file a FOIA request, and the requester never has to explain why they want the records or what they plan to do with them. This is a deliberate design choice: because the law treats a released record as available to the requester and the general public alike, an agency cannot legally ask a requester to justify their interest before deciding whether to release non-exempt material.

The only significant exception is fee treatment, covered below, which does turn on who is asking and why they say they want the records, since commercial, media, educational, and general-public requesters are billed under different statutory fee schedules even though they have identical rights to the records themselves.

There is no citizenship or residency requirement; foreign governments are the main exception, barred by a 2002 amendment from filing requests with intelligence-community agencies. A requester may use a pseudonym or file through a lawyer or organization, and agencies may not demand identification except to verify identity when someone seeks records about themselves.

Because a FOIA release is treated as a release to the world, agencies sometimes post frequently requested records publicly so they do not have to process the same request repeatedly. The 2016 Act made this mandatory for any record requested three or more times.

A FOIA request has no required legal form. It must be in writing and must describe the records sought with "reasonable specificity," meaning enough detail, such as a date range, names, or a specific event, that an agency employee familiar with the files could locate them without an unreasonably broad search. A request that simply asks for "everything you have about X topic" with no other detail is far more likely to be delayed or challenged as improper than one naming specific offices, timeframes, or record types.

Since 2018, FOIA.gov has offered a government-wide portal that routes requests to the correct agency FOIA office, though many large agencies also maintain their own online submission systems. A request can also simply be mailed or emailed directly to an agency's designated FOIA office, whose contact information every covered agency is required to publish.

Practitioners recommend naming the specific office likely to hold the records, giving a date range, identifying document types (emails, memos, calendars, contracts), and citing any known case or file numbers. Agencies must conduct a search "reasonably calculated" to find responsive records but need not do research, answer questions, or create new records.

If a request is unclear or overbroad, the agency is supposed to contact the requester to narrow it rather than deny it, and the 20-day clock can pause once for that. Requesters can also ask for expedited processing by showing a compelling need, such as an urgent need to inform the public about alleged government activity, though agencies grant relatively few of these.

FOIA sets three statutory fee categories, established by the 1986 amendments. Commercial-use requesters pay the agency's full search, review, and duplication costs. Requesters who are news media, educational institutions, or noncommercial scientific institutions pay only duplication fees, and only after the first 100 pages. All other requesters, the default category covering most individuals, get the first two hours of search time and first 100 pages of duplication free, and pay standard rates beyond that.

Any requester, regardless of category, can separately ask for a full fee waiver if they can show that disclosure is likely to contribute significantly to public understanding of government operations and is not primarily in the requester's own commercial interest. In practice, many routine individual requests never generate a bill at all, because the underlying search and duplication costs fall under the free thresholds.

Search fees are billed at the salary rate of the employees doing the search; review fees, for deciding what to redact, may be charged only to commercial requesters. If an agency misses the deadline, the 2007 and 2016 laws generally bar it from charging search fees (and duplication fees for media and educational requesters), with exceptions for very large or unusual requests.

Fee-waiver requests are judged on whether the records concern government operations, are meaningfully informative, will reach a broad audience, and are not primarily commercial. Journalists and researchers frequently get waivers; a requester seeking their own file for a personal matter usually does not, but also usually owes nothing because the search falls under the free thresholds.

Agencies must respond within 20 business days of receiving a request, a deadline the 1996 Electronic FOIA Amendments extended from the 10 working days set in 1974 after the shorter window proved unworkable. Agencies can invoke a 10-business-day extension for "unusual circumstances," such as needing to search multiple field offices or consult another agency, and many large agencies also sort incoming requests into "simple" and "complex" processing tracks so straightforward requests aren't stuck behind a backlog of harder ones.

In practice, the statutory clock and the real-world wait are often very different things. Because the law provides no meaningful penalty for a missed deadline beyond letting the requester treat the delay as a constructive denial and appeal or sue, high-volume agencies with large backlogs routinely take many months, and sometimes years, to produce records for complex requests, a gap documented annually in agencies' own reports to the Justice Department.

The 20-day clock starts when the proper agency component receives the request and can be tolled once for a clarification and to resolve fee issues. "Unusual circumstances" allow a 10-day extension by letter; for very large requests an agency may negotiate a longer timeline or invoke "exceptional circumstances" in litigation to ask a court for more time.

Agencies' annual reports show wide variation: some components answer simple requests in days, while complex requests at agencies like the FBI, State Department, and CIA commonly take one to several years, with average processing times for complex requests at the busiest agencies measured in hundreds of days.

A requester who is denied records in whole or in part, whether because an agency claims an exemption applies, says no responsive records exist, or simply fails to respond within the statutory deadline, can file an administrative appeal directly with the agency, which the FOIA Improvement Act of 2016 requires agencies to allow requesters at least 90 days to file. Administrative appeals are decided by the agency itself and cost the requester nothing.

If the administrative appeal fails, or an agency again misses its own deadline, the requester can sue in federal district court, where, unusually for administrative law, the agency bears the burden of proving the withholding was lawful rather than the requester having to prove it was not. Requesters who substantially prevail in FOIA litigation can also recover reasonable attorney's fees, a provision added by the 1974 amendments specifically to make litigation viable for requesters without deep pockets.

An administrative appeal usually goes to the agency's general counsel, which must decide it within 20 business days (extendable by 10). If the agency stops responding entirely, the requester is deemed to have exhausted administrative remedies and may sue immediately.

In district court the case is usually resolved on cross-motions for summary judgment supported by a "Vaughn index," a document-by-document justification the agency must file for each withholding. The court reviews the withholdings de novo and can order release, but cannot impose fines; the main leverage for requesters is the fee-shifting provision and the risk of an adverse ruling.

Federal agencies received a record 1,199,699 FOIA requests government-wide in fiscal year 2023, the first time the annual total topped one million, according to the Justice Department's Office of Information Policy, which compiles every agency's mandatory annual report. Agencies processed 1,122,211 requests that same year, and the government-wide backlog of unresolved requests actually fell slightly, by nearly 3 percent, even as incoming volume kept climbing.

Request volume is heavily concentrated: agencies handling large numbers of individual case files, most notably the Department of Homeland Security's Citizenship and Immigration Services component, which processes requests from immigrants seeking their own records, account for a large share of the government-wide total on their own, meaning national FOIA statistics are shaped as much by immigration and benefits caseloads as by investigative journalism or public-interest research.

The FY2023 total of nearly 1.2 million requests was up from about 928,000 in 2022 and roughly 597,000 a decade earlier. The government-wide backlog has hovered around 200,000 to 300,000 pending requests in recent years, and a handful of agencies, DHS, the FBI, the State Department, hold most of it.

USCIS alone accounts for hundreds of thousands of requests a year, mostly noncitizens obtaining copies of their own immigration files for use in legal proceedings, and it has adopted a separate online system and records-access alternatives to reduce FOIA volume. National FOIA statistics therefore reflect immigration casework as much as journalism or research.

Exemption 1 protects records that are properly classified under a presidential executive order to protect national defense or foreign policy, currently Executive Order 13526. An agency must show both that the information meets the substantive standard for classification and that it was, in fact, classified through the proper procedure, not simply that a classification stamp appears on the document.

Because federal judges generally lack independent access to the intelligence or diplomatic context behind a classification decision, courts have historically given agencies substantial deference on Exemption 1 claims, though the 1974 amendments gave judges the explicit authority to review disputed classified records privately (in camera) rather than simply accepting an agency's word, a power that did not exist under the original 1966 Act.

Executive Order 13526, issued by President Obama in 2009, sets the current classification rules, including the categories that may be classified (military plans, weapons, intelligence sources and methods, foreign relations) and a bar on classifying information to conceal wrongdoing or avoid embarrassment. Courts have allowed agencies to classify or re-classify information after a FOIA request if done in good faith.

Judges review Exemption 1 claims largely through agency declarations describing why release would harm national security, and they rarely order disclosure over a classification claim. The Interagency Security Classification Appeals Panel and the mandatory declassification review process offer separate, non-FOIA routes to challenge classification.

Exemption 2 covers records related solely to an agency's internal personnel rules and practices, things like employee parking policies or internal building-access procedures, not matters of genuine public interest. For decades, some agencies stretched this narrow exemption into a broad "High 2" theory covering any internal technical or security-sensitive information, even when it had nothing to do with personnel matters.

The Supreme Court ended that practice in Milner v. Department of the Navy (2011), an 8-1 decision holding that Exemption 2 covers only genuine human-resources and employee-relations records, not the explosives-storage maps and safety data the Navy had tried to withhold under the "High 2" theory. Agency citations of Exemption 2 fell sharply in the years after Milner, according to tracking by the Reporters Committee for Freedom of the Press.

Before Milner, the D.C. Circuit's "High 2" doctrine, from Crooker v. ATF (1981), had let agencies withhold internal records whose disclosure would risk circumvention of the law, a category far broader than personnel rules. Agencies used it for guidelines, security plans, and investigative manuals.

After Milner (2011), much of that material shifted to Exemption 7(E) for law-enforcement techniques or Exemption 1 for classified security information, so the total amount withheld did not necessarily fall even as Exemption 2 citations dropped sharply. Exemption 2 is now one of the least-invoked exemptions.

Exemption 3 incorporates withholding requirements Congress has written into other, separate federal statutes, letting those specific laws control instead of FOIA's general disclosure rule. Common examples include Internal Revenue Code provisions protecting individual tax return information, the Atomic Energy Act's restrictions on nuclear weapons design data, and statutes protecting the identities of certain intelligence sources.

To qualify under Exemption 3, the other statute must either leave an agency no discretion to disclose at all, or set specific, particular criteria for withholding, or specify particular types of records to withhold; a vague general reference to confidentiality in another law is not enough, a limit Congress added in 1976 after agencies had tried to use overly broad outside statutes to avoid FOIA's more specific standards.

There are well over 100 "Exemption 3 statutes" recognized by courts and catalogued by the Justice Department, including the National Security Act's protection of intelligence sources and methods, Rule 6(e) grand-jury secrecy, the Census Act, and provisions shielding air-safety and nuclear-security information. A 2009 amendment requires any statute enacted after that date to cite FOIA expressly to qualify.

Disputes often turn on whether the outside statute mandates withholding or merely permits it. The Supreme Court in CIA v. Sims (1985) read the National Security Act's "sources and methods" language broadly, while lower courts have rejected agency attempts to shoehorn general confidentiality clauses into Exemption 3.

Exemption 4 protects trade secrets and commercial or financial information that is privileged or confidential, covering things like proprietary formulas, detailed sales data, or contract pricing information a company submitted to a federal agency, often because the agency required the submission as a condition of doing business or receiving a benefit.

The legal test for what counts as "confidential" changed significantly in Food Marketing Institute v. Argus Leader Media (2019), a case that began when a South Dakota newspaper sought store-by-store SNAP (food stamp) redemption data from the Department of Agriculture. The Supreme Court, in a 6-3 decision, discarded the decades-old lower-court "substantial competitive harm" test and held that information is confidential under Exemption 4 whenever it is both customarily kept private by its owner and provided to the government under an assurance of privacy, a standard transparency advocates have argued makes it considerably easier for companies to shield commercial data from disclosure.

Before releasing information a business submitted, an agency must under Executive Order 12600 give the submitter notice and a chance to object, the "reverse FOIA" process; if the agency decides to release over the objection, the submitter can sue to block it under the Administrative Procedure Act.

After Argus Leader (2019), the key questions are whether the company customarily keeps the information private and whether the government gave an assurance, express or implied, of confidentiality. The Justice Department has advised that where an agency provided no such assurance, older "competitive harm" analysis may still be relevant, leaving the post-2019 standard somewhat unsettled in the lower courts.

Exemption 5 protects inter-agency and intra-agency memoranda that would not be available to a private party in ordinary civil litigation, primarily material covered by the deliberative-process privilege (candid draft recommendations and internal policy discussion before a final decision is made), the attorney-client privilege, and attorney work product. The rationale, first articulated by the Supreme Court in EPA v. Mink (1973), is that officials need room for frank internal debate before committing to a final position.

The 2016 FOIA Improvement Act placed real limits on this exemption for the first time, adding a 25-year sunset so the deliberative-process privilege specifically no longer applies to records once they are 25 years old or more, a change aimed directly at agencies that had used Exemption 5 to withhold decades-old internal drafts with no continuing sensitivity, according to the Justice Department's own summary of the 2016 Act.

The deliberative-process privilege protects "predecisional" and "deliberative" material, drafts, recommendations, and give-and-take, but not purely factual content that can be segregated, and not a policy that has been adopted and is being used as the agency's working law, lines the Supreme Court drew in Sears (1975) and Renegotiation Board v. Grumman (1975).

In U.S. Fish and Wildlife Service v. Sierra Club (2021) the Court held that draft biological opinions never finalized remained privileged, narrowing when a "draft" becomes a disclosable final document. The 2016 Act's 25-year sunset applies only to the deliberative-process privilege, not to attorney-client or work-product material within Exemption 5.

Exemption 6 protects personnel, medical, and "similar" files when disclosure would constitute a clearly unwarranted invasion of personal privacy, requiring agencies and courts to balance the individual's privacy interest against the public interest in disclosure, which FOIA case law defines narrowly as the extent to which disclosure would shed light on what the government itself is doing, not general public curiosity about a private individual.

The Supreme Court applied a closely related privacy standard in National Archives and Records Administration v. Favish (2004), a unanimous decision holding that the family of Vince Foster, a deputy White House counsel whose death was ruled a suicide, could invoke a recognized privacy interest to keep the government from releasing graphic death-scene photographs, and that a requester seeking to overcome a family's privacy objection needs evidence, not mere speculation, of government wrongdoing.

The Court held in Department of State v. Washington Post Co. (1982) that "similar files" is read broadly to mean any government record containing information that applies to a particular individual, so even a name and address can trigger the balancing test. The public-interest side of the balance counts only information that sheds light on government conduct.

In Department of State v. Ray (1991) and Reporters Committee (1989) the Court emphasized that the requester's identity and purpose are irrelevant to the balance, since any release is a release to all. Agencies routinely redact names, home addresses, and similar identifiers under Exemption 6 while releasing the substantive record.

Exemption 7 protects records or information compiled for law enforcement purposes, but only to the extent disclosure would cause one of six specific harms Congress listed: interfering with an active proceeding (7A), depriving someone of a fair trial (7B), constituting an unwarranted invasion of personal privacy (7C), disclosing a confidential source (7D), revealing sensitive law enforcement techniques (7E), or endangering someone's life or physical safety (7F).

Exemption 7(C), the privacy sub-part, has generated the most litigation. In Department of Justice v. Reporters Committee for Freedom of the Press (1989), the Supreme Court unanimously held that an individual's compiled FBI criminal history "rap sheet" is categorically exempt from disclosure, even when portions of the same information are technically available piecemeal from scattered local courthouses, because compiling scattered records into one accessible file itself creates a privacy interest, a concept the Court called protecting a person's "practical obscurity."

The threshold question is whether the record was "compiled for law enforcement purposes"; the Supreme Court in FBI v. Abramson (1982) held that information keeps that character even when later summarized in a non-law-enforcement document. Agencies with mixed missions must show a nexus to their enforcement functions.

7(A) is temporary and expires when the related proceeding ends, while 7(C) and 7(D) can be permanent. In NARA v. Favish (2004) the Court extended 7(C) privacy to a decedent's family, and in Nation Magazine (1995) the D.C. Circuit limited categorical withholding by requiring agencies to consider whether some information could be released without identifying individuals.

Exemption 8 protects records related to the examination, operation, or condition of banks, credit unions, and other financial institutions that federal regulators such as the Federal Reserve, the FDIC, and the Office of the Comptroller of the Currency oversee, covering things like confidential bank examination reports and supervisory ratings.

The rationale, largely undisputed compared to the other exemptions, is that banks and their regulators need to be able to discuss a bank's financial health candidly, including early warning signs of instability, without those candid assessments becoming public and potentially triggering the very bank run or loss of depositor confidence the supervisory process is trying to prevent.

Courts read Exemption 8 very broadly, protecting essentially all records that relate to bank supervision, on the view that Congress wanted no second-guessing of what counts as an "examination" record. It covers not just examination reports but also correspondence, memos, and data generated in the supervisory relationship.

The 2008 financial crisis produced litigation over how far Exemption 8 reaches: Bloomberg and Fox News won release of Federal Reserve emergency-lending records in 2011 after courts found the loan data was not shielded, but supervisory examination material generally remained protected. Dodd-Frank added its own confidentiality provisions layered on top of Exemption 8.

Exemption 9 is FOIA's narrowest and least-litigated exemption, protecting geological and geophysical information and data, including maps, concerning wells, primarily oil, gas, and other mineral exploration data that private companies submit to federal agencies. Congress added it to prevent competitors from using a FOIA request to obtain a rival firm's expensive, privately funded exploration data at no cost.

Because Exemption 4's protection for confidential commercial information already covers much of the same ground, Exemption 9 is invoked far less often than the other eight exemptions in agencies' annual FOIA reports to the Justice Department, and it has generated comparatively little appellate case law over FOIA's nearly six-decade history.

The exemption traces to the oil-and-gas leasing context: exploration firms spend heavily on seismic surveys and well logs, and a competitor could otherwise file a FOIA request to the Bureau of Ocean Energy Management or the Bureau of Land Management to obtain that data for free. It covers the raw geological and geophysical data and maps, not agency analyses of them.

Reported use is minimal, typically a handful of invocations per year government-wide, and there is almost no appellate case law interpreting it. Most disputes over energy-company data are litigated under Exemption 4 instead, where the confidentiality test and the reverse-FOIA process are better developed.

Beyond the nine numbered exemptions, agencies can sometimes lawfully refuse to say whether responsive records even exist, a technique known as a Glomar response. It takes its name from Phillippi v. CIA, a 1976 D.C. Circuit case in which journalist Harriet Ann Phillippi sought CIA records about the Hughes Glomar Explorer, a ship secretly used to try to recover a sunken Soviet submarine; the court held the CIA could refuse to confirm or deny the records existed at all, since simply admitting a record existed would itself reveal the classified connection between the CIA and the ship.

A Glomar response must still be justified under one of the standard exemptions, most often Exemption 1 for classified material or Exemption 7 for law enforcement records, and courts have pushed back when they conclude an agency is using it too broadly for information that is not genuinely sensitive; it remains, decades later, one of the most contested tools in national-security FOIA litigation.

A Glomar response can be defeated by "official acknowledgment": if the government has already officially and publicly confirmed the existence of the specific records, it cannot then refuse to confirm or deny them. Courts applied this in ACLU v. CIA (D.C. Cir. 2013), ordering the CIA to process a request about drone strikes after officials had publicly discussed the program.

Glomar is used most in requests about surveillance, watchlists, informants, and covert operations, and requesters increasingly challenge it by pointing to leaks, official statements, or prior releases. The related "no number, no list" response, refusing to say even how many responsive documents exist, is a further step courts scrutinize closely.

Where FOIA governs access to existing records, the Government in the Sunshine Act of 1976 governs access to the meetings themselves. It requires roughly 50 multi-member federal boards and commissions, bodies headed by two or more presidentially appointed members such as the Federal Communications Commission, the Securities and Exchange Commission, and the Federal Trade Commission, to hold their formal deliberative meetings in public and to give advance public notice of the time, place, and subject matter.

The Act includes its own set of exemptions closely mirroring several FOIA exemptions, letting a covered agency close a portion of a meeting to discuss, for example, active law enforcement matters or information that would meet FOIA's Exemption 4 standard for confidential commercial data, but it does not apply to single-administrator agencies such as the Environmental Protection Agency or the Department of Justice, which have no multi-member board whose meetings the law was designed to open.

A meeting is covered when enough members to take action deliberate on official business; agencies must vote publicly to close a meeting and keep a transcript or recording of closed portions, which can later be requested. The Act was passed in 1976 alongside amendments to the Federal Advisory Committee Act as part of a post-Watergate transparency wave.

Agencies have narrowed the Act's bite by conducting business through staff, written "notation voting," and one-on-one member briefings that fall below the quorum trigger, and a 1984 Supreme Court case (FCC v. ITT World Communications) held that informal international consultations were not "meetings." Reform proposals to broaden it have not passed.

Congress passed the Privacy Act of 1974 the same year it strengthened FOIA, and the two laws are often described as companion statutes. Where FOIA lets any person request agency records generally, the Privacy Act gives individuals a specific right to access and request correction of the records a federal agency keeps about them personally in a "system of records" retrievable by name or other personal identifier, and it separately restricts agencies from disclosing those personal records to third parties without the individual's consent.

The two laws can point in different directions on the same document: a citizen requesting their own file typically gets broader access under the Privacy Act than a stranger requesting the same file under FOIA would, since FOIA's Exemption 6 personal-privacy protection is specifically designed to prevent third parties from using FOIA to bypass the Privacy Act's stricter consent requirements.

The Privacy Act requires agencies to publish descriptions of their "systems of records" in the Federal Register, limits disclosures to twelve enumerated exceptions (including "routine uses" the agency has published), and allows civil suits for damages for willful violations. It applies to U.S. citizens and lawful permanent residents.

It has significant carve-outs: law-enforcement and intelligence systems can be exempted from the access and amendment provisions, and the "routine use" exception has been criticized as a loophole that lets agencies share personal data widely. Requesters seeking their own records commonly file under both FOIA and the Privacy Act so the agency applies whichever gives more access.

The Federal Advisory Committee Act (FACA), passed in 1972, requires most outside advisory committees that federal agencies establish, groups of non-government experts convened to give the government formal recommendations, to hold open meetings, publish advance notice, keep detailed minutes, and make those minutes and other committee records available to the public.

FACA was written specifically to stop agencies from using ostensibly independent advisory panels to develop policy positions behind closed doors while claiming the resulting recommendations came from a neutral outside body; it has been at the center of several high-profile disputes over the composition and transparency of task forces convened by different administrations to develop energy, health, and regulatory policy.

FACA requires a charter, a designated federal officer at every meeting, balanced membership, open meetings with Federal Register notice, and public availability of minutes and documents "made available to or prepared for" the committee. GSA administers the government-wide system, which includes on the order of 1,000 chartered committees.

Litigation has tested its limits: in Public Citizen v. Department of Justice (1989) the Supreme Court held the ABA's judicial-nominee evaluation panel was not a FACA committee, and Cheney v. U.S. District Court (2004) sent back a suit over the 2001 energy task force, holding that private participants do not automatically make a White House group a covered committee.

Congress passed the Presidential Records Act (PRA) in 1978, directly in response to the Nixon administration's attempt to treat its Watergate-era tapes and papers as Nixon's personal property. The PRA established that the official records of a president's time in office belong to the public, not the individual who held the office, and places them in the National Archives' custody once a president leaves.

The PRA and FOIA interact in an important, easily misunderstood way: presidential records are generally not subject to FOIA requests while a president remains in office, and even after a president leaves, the PRA lets outgoing presidents restrict public access to certain sensitive categories of their records for up to 12 years, after which most, though not all, become subject to ordinary FOIA processing through the National Archives.

Under the PRA the Archivist takes custody of a president's records when the term ends, and the former and incumbent presidents can each assert constitutional privileges to delay release. Access requests are processed under FOIA rules beginning five years after the president leaves, subject to up to six categories the departing president may restrict for up to 12 years.

The 2001 executive order that let former presidents and their families indefinitely block release was revoked in 2009. Disputes over the PRA's scope, including messaging-app records and its interaction with criminal law over classified documents, have recurred; the Act itself provides no criminal penalty and relies on the Archivist and the courts.

The Inspector General Act of 1978 created independent watchdog offices, now numbering more than 70 across the federal government, embedded within individual agencies but structurally independent of the agency head, tasked with auditing programs and investigating waste, fraud, and abuse. Inspectors General publish regular, often highly detailed public reports and must report serious problems directly to Congress, operating as an ongoing internal check that does not depend on any single outside requester filing a FOIA request.

Unlike FOIA, which is reactive and requester-driven, Inspector General offices proactively choose what to investigate and publish, giving them a distinct transparency role: FOIA lets the public pull specific records it already knows to ask for, while Inspectors General push out findings the public might never have known to request in the first place.

IGs are appointed by the president and Senate-confirmed at large agencies, or by the agency head at smaller ones, and can be removed only with 30 days' written notice to Congress explaining the reasons, a protection Congress strengthened in 2022. They have subpoena power for documents, their own investigative staff, and law-enforcement authority in many cases.

The Council of the Inspectors General on Integrity and Efficiency coordinates the community and runs oversight.gov, a public database of IG reports. IG findings frequently become the basis for later FOIA requests and news coverage, but the offices operate on their own initiative and referrals, not requester demand.

The Government Accountability Office (GAO), a nonpartisan agency that works for Congress rather than the executive branch, conducts its own independent audits and investigations of federal programs and regularly reports findings, including on FOIA administration itself, directly to Congress and the public. Because GAO works for the legislative branch, it operates entirely outside FOIA, which applies only to executive branch agencies.

GAO's recurring reports on FOIA backlogs, processing delays, and agency compliance function as a form of oversight-driven transparency distinct from FOIA litigation, since GAO can compel agency cooperation and access internal data through its own statutory audit authority in ways an ordinary FOIA requester cannot.

GAO, led by the Comptroller General on a 15-year term, audits programs, evaluates policy, issues legal opinions on federal spending, and maintains the "High Risk List" of programs vulnerable to waste and mismanagement. Its reports are public, and agencies must report back on whether they implemented GAO recommendations.

GAO can sue an agency to enforce its access to records, a power at issue when it challenged the Bush-era energy task force in Walker v. Cheney (2002, dismissed on standing grounds). Because it works for Congress, its own records are outside FOIA, though it voluntarily discloses most non-sensitive material.

FOIA applies only to the federal government; every state has its own, separate public records or "sunshine" law governing access to state and local government records, and these laws vary considerably in scope, exemptions, fees, and enforcement mechanisms. A record held by a city police department or a state agency is governed entirely by that state's law, not by FOIA, even when the underlying program involves federal funding.

Because there are 50 different state frameworks plus the federal law, a single investigative project spanning multiple states, or federal and state governments together, often requires filing under several legally distinct request regimes at once, each with its own deadlines, fee rules, and exemption categories, a practical complexity that state and national press-freedom and open-government organizations regularly work to help requesters navigate.

State laws vary in fundamental ways: some (Florida, Texas) have strong presumptions of openness and quick deadlines; others impose long response times, high fees, or broad exemptions for "working papers" and law-enforcement records. Enforcement ranges from an ombudsman (Connecticut, Texas) to lawsuits only, and a few states restrict requests to state residents, a limit the Supreme Court upheld in McBurney v. Young (2013).

Legislative and judicial records are often excluded from state open-records laws just as they are from FOIA, and many states also have open-meetings laws paralleling the federal Sunshine Act. National groups such as the Reporters Committee for Freedom of the Press and the National Freedom of Information Coalition publish state-by-state guides for requesters.