The Cyr Team · High-Value Questions
Private But Not Hidden
Choosing Privacy Without Market Invisibility
June 2026
A proposed model for resolving the private-listing conflict, offered for industry discussion. It uses BrightMLS as a concrete example because its forms state the options plainly; other MLSs are structured differently, but the concept carries. This is not a description of deployed infrastructure.
The fight over private listings has been framed as a choice between two things that were never actually opposites. On one side, an open market: every home in the shared MLS record, visible to every buyer and every agent. On the other, the seller's right to privacy: the quiet sale, the controlled showings, the home that does not appear on a public portal with a day count ticking up beside it.
The industry has spent two years treating these as enemies. They are not. The conflict exists because of a single conflation, one assumption that almost everyone has accepted without examining it: that putting a listing into the MLS and displaying it to the public are the same act.
They are not the same act. And once you separate them, most of the fight dissolves. The trouble is that the options the seller is actually offered today do not separate them cleanly, and the gap between what those options provide and what a seller might genuinely want is where the wall gets built.
This is not one more argument about whether listings should be private or public. It is a proposal for a mechanism. The same kind of governed access layer that AI and MCP now make possible could let a seller's documented, informed-consent decision determine who sees what, member by member, so a home can be kept from the public without being hidden from the market. The debate has been stuck on a binary because the tooling only offered a binary. The argument here is that the tooling can change, and what should govern it is the seller's documented decision, not the broker's preference.
What the seller is actually offered
Start with what exists today, because the real options are more specific than the debate usually admits. Take BrightMLS, the dominant MLS across this region, whose listing forms lay the choices out in plain language. Other MLSs build this differently, but the shape of the problem is the same everywhere.
When a seller lists, a choice is made about how the home will be marketed, and that choice should be the seller's, made through informed consent, with the broker's job being to lay the options out plainly. In Bright's own form, the meaningful options come down to three states.
The first is full public marketing. The listing goes into the MLS and is shared with other subscribers and with the public websites and apps that pull their data from the MLS or are fed it through the IDX. Everyone sees it: every agent, every buyer, Zillow, Redfin, the whole open market. Bright's form calls this "Internet: Yes."
The second is what Bright labels "Internet: No." The listing still goes into the MLS, shared with the area's licensed agents, but the broker instructs Bright not to send it to public websites and apps. The public does not see it. Every member agent does.
The third is the office exclusive. Here the seller signs a separate instruction telling the broker not to submit the listing to the MLS at all, restricting marketing to the brokerage's own network. No public site sees it. No outside agent sees it. Only the listing brokerage and its own agents know it exists. To get there, the home leaves the shared record entirely, meaning it is kept out of the MLS that every other member relies on.
Three states. And the names hide how different they really are.
The missing option is not another kind of private network. The seller should be able to hide the home from the public without hiding its existence from the cooperative market. Nothing on the current menu does that, and the gap is what pushes sellers toward the wall.
The privacy that is not private, and the privacy that hides too much
Here is the problem your options leave you with, and it is the heart of why the wall keeps getting built.
The middle option, MLS-only, sounds like the answer for a seller who wants privacy without disappearing. But look at what it actually does. When a listing is in the MLS but not sent to the public, every one of the area's licensed agents still sees the complete record: the full address, the photographs, the interior shots, the price, and the full listing detail available to MLS subscribers. From inside the system, a member often cannot even tell a not-publicly-marketed listing apart from a fully public one. They look the same. The only thing the "Internet: No" flag changed is whether Zillow got a copy.
So the middle option is privacy from the public, and no privacy at all from the trade. For many sellers that is fine. But for the seller who actually wants discretion, the public figure, the family in a sensitive situation, the owner with a genuine security concern, the person who simply does not want a hundred thousand strangers with licenses paging through photos of their bedroom, "MLS-only" does not deliver privacy in any meaningful sense. It just narrows the audience from everyone to every agent.
That seller is then left with only one tool that delivers real discretion: the office exclusive. The wall. To get privacy that actually feels private, they have to leave the shared record entirely, which means no outside agent can see the home exists at all, which means a member with a perfectly matched buyer is locked out, and which means, according to the research BrightMLS cites on its own forms (available at BrightMLS.com/Research), the home may sell for less and take longer.
This is the trap, and it is structural. Today's choices run from "everyone sees everything" to "the entire trade sees everything" to "no one outside the brokerage sees anything." There is no setting in between. There is no way to say: let agents know the home exists and reach out to the listing agent about it, without exposing my address and my photographs to all hundred thousand of them. The dial only has those three notches, and two of them expose the full record while the third hides it completely. The seller who wants genuine, limited privacy is pushed to the wall, not because the wall serves them, but because nothing else on the menu offers privacy at all.
Why the lesser option goes unused, and the wall gets chosen
This explains something the debate usually skips. If MLS-only privacy exists, and it keeps the home in the shared record where it sells better, why is it so often passed over for the office exclusive?
Part of the answer is what we just covered: MLS-only is not private enough for the seller who actually wants discretion, so it does not solve their problem. But part of the answer is less flattering, and it belongs on the table too.
The office exclusive does one more thing the MLS-only option does not. By keeping the listing inside the brokerage's own walls, it gives that brokerage the first and sometimes only shot at representing the buyer too. A home no outside agent can see is a home whose buyer is more likely to come from inside the house. It is worth being precise about which conflict this is. The old, familiar version is the single agent who works both sides of the same deal, the double-dip, and it is the one everyone already recognizes and most states already regulate. The structural version is quieter and harder to see: the buyer is captured at the brokerage level and handed to a different agent at the same firm, so no single person sits on both sides and the arrangement looks clean, while the brokerage still collects both sides of the commission and the fiduciary wall has quietly become an internal policy between two designated agents rather than a real separation. Walling off the listing is what makes that capture possible, and it is available only when the listing is hidden from every agent outside the firm. A model that suppresses the visible double-dip while maximizing the structural double-end is not fixing the conflict. It is making it harder to see.
So the office exclusive sits at a convenient intersection. It is the only state that delivers real privacy, and it is the only state that hands the listing brokerage the inside track on the buyer. Those two facts travel together, which makes the wall easy to recommend and hard to read. A seller asking for privacy and a brokerage seeking the double-end both point at the same checkbox, for entirely different reasons, and the form does not distinguish them.
Bright's own office-exclusive form is unusually honest about the cost. It requires the seller to initial an acknowledgment that, by not promoting the home through the MLS, they are "substantially reducing the number of potential buyers and real estate agents who can learn about the property." The seller signs a statement that the choice works against their own market exposure. This does not make the office exclusive wrong. It can serve a seller, when the seller knowingly prioritizes something else, privacy, security, discretion, control over timing, above the broadest possible exposure and the price it tends to bring. That is a legitimate thing to prioritize. What the form makes clear is that the office exclusive trades away exposure, openly, on the record. It is seller-serving only when the seller has understood that trade and chosen it deliberately. As an unexamined default, it costs the seller the very thing they hired an agent to provide, without their having weighed it.
Submission is not display
The office exclusive trades away exposure, openly, on the record. It is seller-serving only when the seller has understood that trade and chosen it deliberately.
So picture the setting that is missing, the notch on the dial that does not exist today.
A listing could be in the MLS, and a member agent could see that it exists and enough to act on it, the property type, the general area, a price or price range, the listing broker's contact, and the date the privacy ends, without seeing the full address, the photographs, the seller's identity, or the public remarks. The public sees nothing. Other agents see enough to know to call, and no more. Real privacy from intrusion, real visibility of existence. That is the missing rung: graduated visibility, a true dial rather than three fixed notches. Graduated visibility is not the same as a Coming Soon or delayed-marketing status, which is only a timed ramp toward full public display. It is a persistent permissioned state: the home can remain visible-to-members but not-public for as long as the seller's documented decision specifies, governed throughout rather than counting down to full exposure. And the dial setting is not the agent's to choose. Graduated visibility without a documented seller decision is just a relabeled wall; the documented decision is what authorizes the tier. No documented decision, no restricted exposure state.
Some MLSs have begun moving in this direction, and it is worth being precise about how far. Canopy MLS, for example, now offers three listing-visibility settings: Public, Limited Exposure, and Firm Exclusive. These are a real step, and they confirm the direction the industry is heading. But they are not the missing rung, for two reasons. First, the restricted tiers are still all-or-nothing at the record level: Limited Exposure shows the full listing to every member, the same as Bright's "Internet: No," and Firm Exclusive hides it from everyone outside the brokerage. There is no permissioned middle view where a member sees that a home exists and enough to act without seeing the full address and photographs. Second, the settings move only one way, broader and never back, and they rest on a seller's signed acknowledgment that exposure is being reduced, not on a documented decision that governs the tier. A signature acknowledging a restriction is exactly what the next section distinguishes from a documented decision. So the tiered-status approach validates the problem while leaving the two hardest parts unsolved: the permissioned member view, and the documented seller decision that authorizes it. Those two are what turn a status ladder into graduated visibility.
This does not exist today, and it is worth being precise about why, because the reason points directly at what would have to be built.
It does not exist because the data is not governed at the layer where it would need to be. Today a listing record is shared more or less whole. The "Internet: No" flag is a blunt instrument: it governs whether the public gets a copy, not what any given member is permitted to see. There is no mechanism that returns a different view of the same listing to different requesters based on permission, the full record to the listing brokerage, a limited "exists and is reachable" record to an outside member, nothing to the public. Serving permission-scoped views of one record is not something the current plumbing does. It is exactly what a governed access layer would do.
That governed layer is the same one the market increasingly needs for another reason entirely: AI. Listing data now reaches consumers through AI assistants that pull it through portals, under data-exchange agreements written years ago for displaying listings on websites, not for answering questions. There is no shared, MLS-controlled layer governing how that data is accessed, attributed, or restricted once an AI reaches it. The data is no longer governed at the point where access increasingly happens. The argument for the MLS to claim that governance role is laid out in the companion piece on this site about the MLS and AI access. The point worth making here is that the same governed access layer that would let the MLS feed accurate data to AI is the layer that would make graduated visibility possible. Build it once, and it solves both problems: the AI gets the true, current record under governed terms, and a private listing can be made visible-but-not-exposed under those same terms. The missing rung and the AI-governance gap have the same fix.
So this is not a description of existing infrastructure. It is a description of what becomes possible if the MLS builds the governed layer it is currently ceding to portals and scrapers. With that layer, exposure state becomes a true property of the data: a flag on the record that governs, requester by requester, who sees what. Submission and display come fully apart. The home is in the shared record. Its visibility is a dial, and the dial can sit anywhere between full exposure and existence-only.
What sets the dial, and why that has to be documented
A dial raises a question a switch never did: who sets it, on what basis, and how does anyone know the setting was legitimate?
Here is the rule that has to govern it, and it is the thing that keeps this model from becoming a cleaner-looking wall. The dial should not be manually adjustable by brokerage preference. It should move only when the seller's documented decision authorizes it. No documented decision, no restricted exposure state. The exposure flag is not a setting an agent selects; it is the system expression of the seller's documented choice.
This matters, because a flag any agent can flip to "private" at will just recreates the office exclusive with extra steps. Graduated visibility is only an improvement if the restricted setting reflects a real, informed seller decision rather than an agent's preference. The flag has to be bound to something.
What it should be bound to is the seller's documented decision. Not a signature on a form acknowledging a restriction, the deliberation behind it: the options the seller was shown, the tradeoffs explained and understood, the specific reason for restricting, and the date the privacy ends and the home returns to full display. The underlying standard, a documented listing decision, is described in full on this site, and one instrument that produces that record is the Listing Strategy Decision Record, published by LTC Capital. The point here is not the instrument. The point is that the dial setting is the seller's documented decision, made visible and enforceable. The flag and the record are the same thing. Privacy in this model is never silent, never open-ended, never the agent's call dressed as the seller's, because the setting that governs visibility is the very record of the seller having genuinely chosen it.
So the architecture has two halves, and it needs both. The governed access layer is the mechanism: it makes graduated visibility technically possible, the way the same layer makes governed AI access possible. The documented decision is the authority: it makes any restricted setting legitimate, by binding the flag to a real, informed choice with a reason and an end date. A mechanism without the authority is just a more sophisticated wall. The authority without the mechanism is a good decision with no way to enforce the visibility it chose. Together they build the missing rung.
The part that should reassure the brokerages, not alarm them
It is easy to assume a model like this is aimed against the brokerages building private networks. It is not. At least on their stated terms, it gives them much of what they say they are seeking.
The brokerages advocating for private listings make a specific case. Sellers deserve choice about how their home is marketed. A brokerage should be able to offer its own buyers an early look before the wider market. Those are the stated reasons, and the model satisfies them.
Seller choice? Preserved, and made real, because the dial setting is a documented decision rather than a checkbox.
Privacy? Preserved, and improved. The graduated setting offers something today's options cannot: discretion from intrusion without total invisibility. The seller who wanted real privacy finally has a tool that delivers it without forcing them out of the shared record.
Exclusive early access for a brokerage's own buyers? Preserved. The brokerage holding the listing would have full access to its own record through the same governed layer, could match its private inventory to its own buyers, and serve them first. Nothing in the model stops a brokerage from offering a genuine early, exclusive look. The private phase is intact. The service is intact.
What the model does not preserve
There is one thing the model removes, and naming it precisely is the whole point.
It removes invisibility to fellow members.
In the walled model, the listing is invisible to every member outside the holding brokerage. A member agent representing a perfectly matched, ready, qualified buyer cannot see that the home exists, cannot call, cannot advocate, unless knowledge reaches them by accident: a buyer who happened to drive past a sign, a stray reference, someone who knew someone. Discovery becomes luck rather than a function of the market. And the member shut out is not an outsider with no standing here. They are a fellow member of the same system, with their own right of membership, denied access to a record their membership is supposed to guarantee. In this model, that same member could see the listing exists, even while it is private, and pick up the phone: I have a qualified buyer ready at or above your price. Will you work with me on this one?
It is worth asking, underneath all of this, who actually owns the data, because both defenses of the wall rest on an answer that does not survive scrutiny. The seller owns the home. The listing record is a different matter. The description, the photos, the assembled marketing are not simply the seller's private asset once they are created, brokered, submitted, and governed under MLS participation rules. Layered rights attach to that record, held by the broker who created it, the photographer who may license the images, the MLS that holds it, and the seller who authorized the sale. What the record is not is the seller's alone to wall off. So the first defense, that the listing is the seller's data to keep private, fails at the start.
The second defense is subtler and fails for a better reason. If the broker holds and controls the listing record, can the broker not do as they please with it? Not freely, because the broker's control of that record is not an unencumbered private-property right. It is a membership right. The broker holds and controls the listing only by virtue of belonging to the cooperative, and membership is exactly what carries the obligation to submit and the corresponding right of other members to see what is submitted. You cannot claim the standing that flows from membership while refusing the obligations that come attached to it. In an MLS-mediated transaction, the data does not sit in anyone's private vault. It sits in a compact, governed by rules every member agreed to in order to hold the data at all. The full ownership-and-governance version of this argument is laid out in the governance analysis on this site.
A fair objection arrives here, and it is worth meeting head-on. If the seller simply instructs the broker not to submit the listing at all, then there is no record, and no member's right to see it attaches. That is true under today's rules. But notice why it is true: the only way a seller can currently obtain real privacy is by not submitting, because no permissioned middle state exists. The objection is not a principle. It is a description of missing infrastructure mistaken for one. People reach for "no submission, no record, no right" precisely because the alternative, privacy through governed limited disclosure rather than through total absence, has not been built. So this piece is not claiming that today's compact already requires a listing's existence to be visible. It is arguing that if MLSs want to preserve cooperation in an AI-mediated market, this is the direction the compact should evolve: privacy should govern display, not force a choice between full submission and none. Build the middle state, and the rebuttal dissolves, because the seller no longer has to leave the record to get the privacy they want.
That is why "private but not hidden" imposes on no one's unencumbered property. There is no simple private-property claim here to override. There is a shared record, held under a membership compact, with a seller's informed and documented privacy choice governing its display. The wall was never merely protecting an ownership right. It was overriding the cooperative compact.
The wall was never merely protecting an ownership right. It was overriding the cooperative compact.
When a member with a ready buyer can finally reach the listing agent, the listing agent faces a decision that fiduciary duty already governs. A ready, willing, able buyer at or above asking is exactly the outcome the seller hired the agent to produce. Declining it to protect an in-house transaction is difficult to square with the duty owed to the seller. The model does not impose that pressure. It simply stops hiding the existence of the buyer's opportunity from the seller, and lets the existing duty do its work. What that duty actually requires around an off-MLS decision is laid out in a separate piece on this site.
So here is the clarifying structure, and it sorts the genuine from the strategic without anyone having to allege a motive.
The model gives a brokerage everything it states as its reason for private listings: seller choice, privacy, even improved privacy, and exclusive early access to its own buyers. The only thing it removes is invisibility to fellow members. A brokerage whose intentions match its stated reasons should welcome it, because it delivers the case they have been making, and a better privacy tool besides. A brokerage that objects is objecting to the one thing it removes. And that objection is informative, because the value being defended was never seller choice or privacy or buyer access, all of which the model preserves or improves. It was the invisibility itself, and the inside track on the buyer that invisibility provides.
We do not have to assert what any particular brokerage's objective is. The architecture asks the question for us. Whatever a party accepts or rejects in a model like this tells you which thing they were actually protecting.
The seller disclosure problem
Step back from infrastructure for a moment, because there is a version of this that matters even if no governed layer is ever built. The real test of a private listing was never whether private marketing is allowed. It is whether the seller was shown the consequences in plain language, and understood them, before they agreed.
Did the seller see the difference between full public exposure, MLS-only marketing that still shows the whole record to every agent, and an office exclusive that hides the home from everyone outside the brokerage? Did they understand which buyers each option excludes? Did anyone put the possible price impact in front of them, in dollars, not euphemism? Did they grasp that the "privacy" of the middle option is privacy from the public only, and that the privacy of the wall costs them the open market? Did they choose an expiration date, or was the restriction left open-ended? Without a record that answers those questions, "seller choice" is a slogan, not consent. It is the appearance of a decision standing in for the substance of one.
This is the same standard the documented listing decision exists to meet, and it applies whether the home goes fully public, fully private, or anywhere on the dial. The architecture describes how privacy could be governed in the system. The disclosure standard describes what the seller must actually understand for any of it to count as their choice. The two are the same argument from different ends: the system should make graduated, private-but-not-hidden marketing possible, and the fiduciary should make sure the seller's decision to use it was real.
Choice for all
The word the private-listing argument leans on hardest is choice. The seller's choice. And it is a good word, the right one to build on.
The trouble with the walled version is not that it offers choice. It is that it offers choice to too few, and a poor choice at that. The seller gets a decision they rarely understand, between options that mostly do not fit what they want. The holding brokerage's buyers get access. Everyone else, every other buyer, every other agent, the wider market that determines what the home is actually worth, gets nothing, because they cannot see that the home exists.
A real resolution keeps the word and widens it. The seller still chooses, and the choice is informed, documented, and finally fitted to what they actually want, including genuine privacy that does not require vanishing from the market. The brokerage still serves its buyers first. But the home's existence is visible in the shared record, which means every buyer represented by a member has a meaningful path to it and every member can advocate for their client. Privacy for the seller, real privacy this time. Service for the brokerage. Visibility for the market. A private phase that protects the seller without blinding everyone the seller's sale depends on.
Private, but not hidden.
Choice, but for everyone.