FRCP 5.2 Redaction: E-Filing Court Documents Without Leaking Them

What Rule 5.2 actually requires, and why the tool you use to comply matters as much as the rule itself.

A filing goes out at 11:52pm. Exhibit C is a client's bank statement with the account number blacked out. It is accepted, docketed, and available on PACER within seconds.

Two weeks later opposing counsel mentions the account number in a deposition. Nobody hacked anything. They selected the text underneath your black rectangle, and pasted it.

What happens next is the part that hurts. The document is already public. PACER is scraped continuously by aggregators, researchers and commercial data brokers, so withdrawal does not undo distribution. You are now looking at a motion to seal that arrives too late, a call to a client explaining how their account number entered the public record, and a conversation about whether the disclosure was reasonable under your professional obligations.

This is one of the most common self-inflicted wounds in federal practice, and it has two causes: a misunderstanding of what Rule 5.2 requires, and a redaction tool that never actually removed anything.

What Rule 5.2 Actually Requires

Federal Rule of Civil Procedure 5.2(a) governs personal identifiers in filings. It is worth reading precisely, because most summaries of it — including the ones circulating in firm checklists — get two things wrong.

First: there are five categories, not four. Taxpayer-identification numbers are routinely omitted from internal cheat sheets.

Second: the rule calls for partial redaction, not removal. Rule 5.2(a) says a filing containing these items "may include only" the truncated form. It does not instruct you to obliterate them.

The practical consequence: blacking out an entire date of birth when the rule contemplates showing the year, or an entire account number when the last four are permitted, is over-redaction. It will not usually get you sanctioned, but it can get a filing questioned or make an exhibit useless for identification — and in some districts it will draw a clerk's notice. Redact to the line the rule draws, not past it.

The exceptions worth knowing

Rule 5.2(b) exempts certain filings, including the record of an administrative or agency proceeding, the official record of a state-court proceeding, and filings in an action to enforce or quash an administrative summons. Rule 5.2(c) limits remote electronic access in social security and immigration cases. Rule 5.2(d) permits filing under seal, and 5.2(f) allows a party to file an unredacted copy under seal alongside the redacted public version. Rule 5.2(g) permits a reference list filed under seal.

Whose job this is

Not the clerk's. The Judicial Conference privacy policy and the local CM/ECF procedures in essentially every district place responsibility for redaction on the filing party and its counsel. The clerk's office does not review your exhibits for identifiers, and the ECF system will accept a filing full of them without complaint.

Why a Black Box Is Not a Redaction

Here is the failure that turns a compliance task into a disclosure event.

When you draw a black rectangle over text in a standard PDF editor, you are not deleting anything. You are appending one more drawing instruction to the page's content stream. It paints over the earlier instructions, but the text-showing operators, the character codes and the embedded fonts all remain in the file, at known coordinates, in reading order.

Anyone can retrieve them by selecting and copying, by running pdftotext against the document, or by pushing the file through almost any format converter. No expertise is required. This is the mechanism behind essentially every publicised redaction failure in court filings, government releases and merger documents — the box was drawn on top, the words were never removed.

We covered the mechanics in detail in The Black Box Flaw. The short version: the only method that actually removes the content is rasterization — rendering each page to a flat image, burning the redaction into the pixel data, and rebuilding the PDF from those images alone. There is then no text layer to recover, because there is no text.

For a PACER filing this distinction is everything. A sealed document has controlled access. A public document with a recoverable text layer has no protection at all, and it is being archived by third parties from the moment it posts.

The Upload Problem

So you need real redaction. The obvious move is to search for a PDF redaction tool, and nearly every free result begins the same way: upload your file.

Stop there. The document you are about to upload is an unredacted client exhibit. It is the version with the account numbers, the medical history and the minor's name still in it.

Be precise about what that does and does not mean. Sending a document to a third-party vendor does not automatically waive attorney-client privilege — courts and ethics authorities have generally accepted that using outside service providers with reasonable confidentiality protections is compatible with the duty of confidentiality. The problem is narrower and more practical.

• You must be able to justify the choice. ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent inadvertent or unauthorized disclosure of information relating to the representation. A free web tool you found via search, with terms you did not read and a jurisdiction you cannot name, is difficult to defend as a reasonable effort.
• Competence now includes the technology. Comment 8 to Model Rule 1.1 requires lawyers to keep abreast of the benefits and risks of relevant technology. "I did not know it stored the file" is not a defence a disciplinary body finds persuasive.
• Protective orders rarely permit it. Many orders restrict disclosure of designated material to named categories of people. A cloud PDF processor is generally not one of them.
• You inherit their breach. If that vendor is compromised next year, your client's unredacted exhibit is in scope, and ABA Formal Opinion 483 addresses a lawyer's obligations following a data breach involving client information.

The cleanest way to resolve every one of those questions is to make sure the upload never happens.

A Defensible E-Filing Redaction Workflow

1. Keep the unredacted original. You may need it for a sealed filing under Rule 5.2(f) or a reference list under 5.2(g). Store it under your normal file controls; never transmit it.
2. Redact on a machine you control. If a tool requires an upload, it has joined your chain of custody. RedactLocal runs entirely inside your browser tab, so the exhibit never reaches a server.
3. Scan for the numeric identifiers. Social-security numbers, taxpayer IDs and account numbers follow predictable formats and should be caught mechanically rather than by eye at midnight.
4. Read for the two the machine cannot find. Birth dates and the names of minors require a human. So does context — "the plaintiff's daughter, then fourteen" identifies a minor as surely as a name.
5. Redact to the rule, not past it. Leave the last four digits and the year of birth where Rule 5.2(a) permits them.
6. Flatten the output. Export so the removed text is destroyed rather than covered.
7. Verify before you file. Run pdftotext over the finished PDF, or open it and search for a number you know you removed. If it appears, do not file it.
8. Check the exhibits, not just the brief. The brief is usually clean. The leak is almost always in an attached statement, medical record or contract.

How RedactLocal Fits

RedactLocal is a PDF redactor that runs entirely in the browser. There is no upload endpoint, because there is no backend that accepts files.

Nothing leaves the tab

Your exhibit is read into memory by the browser's own file API, parsed and rendered locally, and exported by your browser's download mechanism. You can confirm this in about ten seconds: open the tool, disconnect from the internet, and redact a document. It keeps working, because there is nowhere for the file to go. No cloud tool survives that test, and it is the whole difference.

Auto-Redact finds the numeric identifiers

The scanner sweeps the document for social-security numbers, taxpayer identification numbers, financial account and card numbers, government ID numbers, emails and phone numbers. Every hit is listed with the line of text around it, and nothing is blacked out until you confirm it. That review step is deliberate: an automatic sweep either over-redacts an exhibit into uselessness or quietly misses something, and only the person who knows the matter can tell the difference.

Mapped against Rule 5.2(a), the scanner mechanically covers three of the five categories — social-security numbers, taxpayer-identification numbers and financial-account numbers. It does not detect birth dates, and it does not detect names, including minors' names. Those two categories are manual work, and the draw-a-box tools are there for exactly that. Any vendor telling you their tool handles all five automatically is selling you a name-recognition model that will miss "the plaintiff's stepson" on page 40.

Redactions are destroyed, then verified

On export, every page is rasterized and the redaction boxes are burned into the pixels. The new PDF is assembled from images alone. The file is then re-opened and inspected before the download appears, reporting the flattened page count alongside the number of selectable characters, text operators, font objects and annotations found. On a correct export those counts are zero — and that report is the closest thing to a receipt you can hand a supervising partner.

Whole exhibit sets at once

Filings are rarely one document. You can queue the whole exhibit set, scan every file in one pass, work through them individually, and export as a single archive. Each redaction can carry a stamp — CONFIDENTIAL, PII REDACTED, or a custom code such as a protective-order designation — burned into the black box so the reader knows the basis for the withholding.

What This Does Not Do

Two limits to know before you rely on any of the above.

Scanned exhibits are not pattern-scanned. The identifier search reads a PDF's text layer. A photographed bank statement or a faxed medical record is an image with no text to match against. RedactLocal reports those pages by number and tells you to review them by eye rather than reporting them clean. Manual redaction and flattened export work normally on them — and note that a scanned exhibit which has been OCR'd by your document system does have a text layer, which is exactly the kind of file people assume is safe because "it's just a picture."

The site loads page analytics. Loading redactlocal.org records a page view, as most websites do. It has no access to your documents, which never leave your tab's memory. We state that plainly, because a tool asking you to trust its handling of data you cannot see should be candid about the data you can.