Last updated: March 2026
Under the Privacy Act of 1974, the default rule is that an agency may not disclose an individual’s records without first getting that individual’s written consent. Of the 13 exceptions to this rule that Congress provided in the law, the routine use is the most flexible—and most misunderstood. It serves as a “policy escape valve” allowing agencies, if they follow the correct process, to add other disclosures where consent won’t work. Routine uses, once in place, act as limitations: the language controls what an agency can legally do.
This document explains, in two pages, about how routine uses are established and how they work.
Learn more about routine use, read the brief: