How to Properly Redact PDFs for FOIA Requests

The fundamental distinction in PDF redaction is between visual redaction and permanent redaction. Visual redaction (incorrect for FOIA): Drawing a black rectangle, adding a black annotation, or placing a black shape over text. The text underneath still exists in the PDF and can often be selected, copied, and pasted into a text editor. This is the method that has caused numerous redaction failures in high-profile cases, including Department of Justice documents, court filings, and congressional reports. Permanent redaction (correct): The text, image, or content is permanently removed from the PDF file. Where it existed, the redacted area contains nothing — no text characters, no image data. What appears as a black box is simply an annotation with no underlying content. To verify whether a redaction is real: try selecting text under a black box. If you can highlight it, or if Ctrl+A selects it, the redaction is not permanent. In Adobe Acrobat Reader, go to Edit > Find (Ctrl+F) and search for a word that should be redacted. If it finds it, the redaction has failed. For FOIA compliance, only tools that perform permanent redaction are acceptable. The two most common compliant tools are Adobe Acrobat Pro (with its Redact tool) and specialized legal redaction software like Relativity, Nuix, or OpenText Redact.

Adobe Acrobat Pro is the most widely used tool for FOIA redaction in government agencies. Its Redact tool (available under Tools > Redact) performs permanent content removal. The redaction workflow in Acrobat has two distinct stages that are easy to confuse. In the first stage, you mark content for redaction — these appear as red boxes on the document. At this point the content is NOT yet removed. You can adjust selections, add more marks, and review. In the second stage, you apply the redactions — this permanently removes the marked content and replaces it with black bars (or whatever redaction appearance you configure). Crucially, you must save the file after applying redactions. The Apply Redactions step does modify the document in memory, but only when saved does the removal become permanent in the file. Some agencies use Save As rather than Save to create a separate redacted copy, preserving the unredacted original in a secured location. Acrobat Pro also allows searching for text to redact (useful for repeating sensitive terms like names or SSNs), and can redact metadata and hidden information through Tools > Redact > Sanitize Document — a critical step often overlooked.

1. 1Open the document in Adobe Acrobat Pro and go to Tools > Redact
2. 2Use 'Mark for Redaction' to draw boxes over all content to be removed — text, images, and any other sensitive elements
3. 3Use 'Find Text' in the Redact panel to search for recurring sensitive terms (names, SSNs, case numbers) and mark all instances
4. 4Review all marked areas carefully using the Comments panel to ensure complete coverage
5. 5Click 'Apply Redactions' and confirm — this permanently removes the marked content
6. 6Use Tools > Redact > Sanitize Document to remove metadata, embedded content, scripts, and hidden data
7. 7Save As a new file with a clear naming convention (e.g., DocumentName_REDACTED.pdf)

Understanding which information is exempt from FOIA disclosure is essential for correct redaction. FOIA has nine statutory exemptions under 5 U.S.C. § 552(b). The most commonly applied are: Exemption 6 (Personal Privacy): Information that would constitute a clearly unwarranted invasion of personal privacy. This typically includes Social Security numbers, home addresses, medical information, and personal financial details of private individuals. Exemption 7 (Law Enforcement): Records compiled for law enforcement purposes that could interfere with proceedings, disclose confidential sources, identify techniques, or endanger individuals. This is among the most litigated FOIA exemptions. Exemption 3: Information specifically exempted by statute (such as classified tax return information, grand jury materials, and certain intelligence community information). Exemption 4: Trade secrets and commercial or financial information obtained from a person that is privileged or confidential. Exemption 5: Inter-agency or intra-agency memorandums or letters protected by attorney-client privilege, deliberative process privilege, or work product doctrine. For each redaction, agencies must track which exemption applies. In many FOIA responses, redacted areas are annotated with the exemption code (e.g., '(b)(6)' or '(b)(7)(C)') rather than blank black boxes. Adobe Acrobat's custom redaction appearance settings can include text within the redaction mark for this purpose.

Metadata is invisible information embedded in PDF files that can reveal sensitive details about the document's history, authors, and processing. For FOIA responses, metadata removal is as important as content redaction. PDF metadata can include: the names of individuals who worked on the document, the software used to create it (which can reveal internal systems), the creation and modification timestamps, prior document titles, and embedded comments or tracked changes. Scanned PDFs may have less embedded metadata than native PDFs, but both should be sanitized. Adobe Acrobat's Sanitize Document function (Tools > Redact > Sanitize Document) removes metadata, embedded content, JavaScript, links, overlapping objects, and other potentially sensitive embedded data. Exiftool (free, command-line) can remove metadata from PDFs: exiftool -all= document.pdf. However, it does not perform content redaction — only metadata removal. Many FOIA processors also convert the final redacted document to a flat image-based PDF as a final step. While this strips all metadata and makes text extraction impossible, it also makes the document less accessible and harder to search. Some agencies use this approach for highly sensitive releases. For documents being released, adding a watermark noting 'Released pursuant to FOIA Request #XXXX' is common practice. LazyPDF's watermark tool can add such notices to document batches quickly and consistently.

Never release a FOIA response without independently verifying that all redactions are complete and permanent. Multiple verification methods should be used. Text extraction test: Use Adobe Acrobat Reader to attempt Ctrl+A (Select All), then Ctrl+C (Copy), then paste into Notepad. If any text that should be redacted appears, the redaction has failed. Search test: Use Ctrl+F to search for specific terms that were redacted — names, SSNs, case numbers. If found, redaction failed. Metadata check: Use File > Properties in Acrobat and examine all metadata fields. Use ExifTool to extract all metadata and review it. Second-reviewer protocol: Many agencies require a second person to independently verify all redactions before release, with a checklist of the specific terms and exemptions applied. For large redaction projects covering hundreds of pages, specialized legal review software like Relativity or Nuix provides audit trails, consistent exemption coding, and built-in quality review workflows that are far more reliable than manual Acrobat workflows. Once verified, protect the released document with LazyPDF's protect tool to prevent further editing, ensuring the document integrity is maintained as you distribute it to the requester.