State Attorneys General Are Rewriting the FOIA Enforcement Playbook—Is Your Organization Ready?

For most of its modern history, public records enforcement at the state level has been a relatively low-intensity affair. Citizens filed complaints, agencies responded—or didn't—and the formal machinery of enforcement moved slowly, if at all. That era appears to be ending.

Across multiple states, attorneys general have begun treating open records violations not as administrative inconveniences to be quietly resolved, but as enforcement priorities worthy of investigative resources, press releases, and, in some cases, litigation. The political and legal environment driving this shift has significant implications for any organization subject to state sunshine laws—and compliance officers who have treated public records compliance as a secondary concern should reconsider that posture.

A Change in Enforcement Philosophy

State AGs occupy a unique position in the public records ecosystem. Unlike federal FOIA, which is enforced primarily through citizen litigation and agency oversight mechanisms, state open records laws vary widely in their enforcement architecture. In some states, the AG's office has explicit statutory authority to investigate complaints, issue advisory opinions, and refer matters for prosecution. In others, enforcement authority is more diffuse, shared among the AG, local prosecutors, and courts.

What has changed in recent years is not primarily the legal authority—it is the willingness to use it. Several factors appear to be driving this shift.

First, public trust in government institutions has declined measurably, and elected AGs in both major parties have identified transparency enforcement as a politically resonant issue. Announcing an investigation into a public agency that stonewalled records requesters plays well across ideological lines, making it an attractive enforcement priority regardless of a state's political complexion.

Second, high-profile national conversations about government accountability—spanning everything from police conduct to public health decision-making during the COVID-19 pandemic—have elevated public expectations for records access. Requesters who were previously willing to accept delays or partial responses are now more likely to escalate complaints, and AG offices are responding to that constituent pressure.

Third, advocacy organizations and journalism nonprofits have become more sophisticated in their use of open records laws, filing coordinated requests, documenting patterns of non-compliance, and bringing those patterns directly to enforcement authorities. This has made it easier for AG offices to identify systemic violations rather than isolated incidents.

Recent Enforcement Trends Worth Watching

Several enforcement patterns have emerged in recent years that compliance officers should treat as directional signals.

Scrutiny of delay as a substantive violation. Historically, agencies that responded late to records requests faced limited formal consequences. An increasing number of AG enforcement actions have treated chronic delay—particularly delay without adequate explanation—as a violation of the underlying statute, not merely an administrative failure. Organizations that have normalized backlog as an operational reality should recognize that this posture is becoming legally untenable in a growing number of jurisdictions.

Expanded scrutiny of exemption claims. AG offices in several states have begun examining whether agencies are applying exemptions accurately or using them as a default mechanism to avoid disclosure. Blanket invocations of deliberative process protections, law enforcement exemptions, or personal privacy exclusions are receiving closer scrutiny, particularly when the same exemption is applied repeatedly across different request types without individualized justification.

Focus on institutional actors, not just agencies. Enforcement attention is no longer confined to government agencies themselves. Contractors, quasi-governmental entities, and private organizations that perform public functions have increasingly been drawn into the scope of open records obligations—and by extension, enforcement actions. Organizations that receive public funding, perform services under government contract, or exercise delegated public authority should assess whether they have adequately analyzed their exposure under applicable state sunshine laws.

Coordination with federal oversight. In some instances, state AG investigations into records practices have surfaced information relevant to federal oversight bodies, creating a multifront compliance challenge. Organizations operating at the intersection of state and federal regulatory frameworks should be particularly attentive to the possibility that a state-level records dispute could attract federal attention.

The Political Dimension of Enforcement

It would be analytically incomplete to discuss AG enforcement trends without acknowledging the political dimension. Attorneys general are elected officials in most states, and their enforcement priorities reflect both genuine legal concerns and political calculus.

This does not mean that enforcement actions are arbitrary or pretextual—in the vast majority of cases, the underlying legal violations are real. But it does mean that the targets of enforcement actions are not selected solely on the basis of legal merit. High-visibility agencies, politically sensitive subject matters, and organizations with reputational profiles that make them useful as enforcement examples are more likely to attract AG attention than equally non-compliant but lower-profile entities.

For compliance officers, this political reality carries a practical implication: organizations that are prominent in their communities, that handle politically sensitive information, or that have previously attracted media attention related to transparency should treat their exposure as elevated, regardless of whether they believe their current compliance posture is defensible.

What Proactive Compliance Looks Like in This Environment

Organizations seeking to position themselves ahead of this enforcement trend should consider several concrete steps.

Conduct a jurisdiction-specific exposure analysis. Open records laws vary significantly across states, and the gap between what an organization believes its obligations are and what a court or AG office would find them to be is often substantial. A formal legal analysis of obligations under each applicable state statute—including any recent legislative amendments or court decisions interpreting those statutes—is a foundational investment.

Document exemption decisions with specificity. When records are withheld, the legal basis should be documented with particularity at the time of the decision, not reconstructed after the fact in response to a complaint. AG offices and courts are increasingly skeptical of post-hoc exemption justifications, and organizations that cannot produce contemporaneous documentation of their reasoning are at a disadvantage in any enforcement proceeding.

Establish an escalation protocol for disputed requests. Organizations that lack a clear internal process for handling contested requests—those involving disputed exemptions, fee waiver disagreements, or requester challenges to search adequacy—tend to handle disputes inconsistently and reactively. A defined escalation protocol, including legal review thresholds and response timelines, reduces both compliance risk and litigation exposure.

Monitor AG guidance and advisory opinions. Most state AG offices publish advisory opinions on open records questions, and these opinions—while not always binding—signal enforcement priorities and interpretive positions. Compliance officers who monitor AG output in their operating states will have earlier warning of emerging enforcement concerns than those who wait for formal action.

Transparency as Institutional Credibility

The enforcement landscape described here is not primarily a threat to organizations that take their transparency obligations seriously—it is a threat to those that have treated public records compliance as a low-priority administrative function. For organizations that invest in clear processes, accurate exemption analysis, and responsive records management, increased AG scrutiny represents not a risk but a competitive differentiator.

At InfoAct Compliance, our view is that confidence in transparency comes from building systems that can withstand scrutiny—not from hoping that scrutiny never arrives. The organizations best positioned for the current enforcement environment are those that have made compliance a genuine institutional priority, not a checkbox exercise. In a landscape where state AGs are increasingly willing to make examples of non-compliant entities, that distinction has never mattered more.