When most people hear the phrase “privacy controls,” they picture toggles: an Incognito window in Chrome, a Global Privacy Control signal broadcasting “do not sell my data,” an Android permissions screen, or the account checkup buried in a Google settings menu. These tools matter, and a lot of people use them. Keyword data shows “privacy settings” draws roughly 74,000 searches a month in the United States alone, more than four times the volume for “identity theft” at 18,100. People are actively looking for ways to lock down their digital footprint.

But there is a category of personal information these controls were never built to reach: the public record. Deeds, mortgages, liens, and property filings sit in county databases that predate the modern internet, and no browser extension, app permission, or opt-out signal can touch them. That gap is exactly what Public Records Safety was created to address, and it is worth understanding before you assume your privacy settings have you fully covered.

This is not a small or rare category of data. Property records exist for nearly every homeowner, and county portals were designed decades before anyone anticipated automated bots pulling records at machine speed. Understanding where consumer privacy controls end, and where a separate set of protections needs to begin, is the first step toward closing that gap.

The Privacy Controls Most People Already Know

Consumer privacy tools have matured quickly over the past few years, and most of them fall into a few familiar categories:

• Global Privacy Control (GPC): An open browser signal, drawing about 1,300 monthly searches, that automatically tells websites “do not sell or share my personal information” without requiring a manual opt-out on every site.
• Browser-level protections: Incognito mode in Chrome, Enhanced Tracking Protection in Firefox, Intelligent Tracking Prevention in Safari, and the tracking blockers built into Brave.
• Account-level checkups: Consolidated dashboards, such as Google’s privacy checkup, that let you review ad personalization and manage what is saved to your account.
• Device permissions: On Android, reviewing app access to your camera, microphone, and contacts under Security and Privacy; on iOS, managing location and tracking requests under Settings > Privacy & Security.
• Organizational standards: Administrative, technical, and physical safeguards that larger institutions follow, often benchmarked against frameworks published by NIST’s Computer Security Resource Center.

Each of these does something real. GPC reduces the burden of manually opting out of data sales one site at a time. Device permission reviews limit what apps can quietly collect in the background. But every one of them governs data that lives inside a private company’s ecosystem: your browser, your phone’s operating system, or a platform account. None of them reach the recorder’s office down at the county courthouse.

The Public Record Blind Spot

Public record systems were built on a different premise entirely: transparency. County recorders, clerks, and assessors maintain property and legal filings specifically so that real estate transactions, lending decisions, and legal processes can happen in the open. That openness is valuable, but it also means there has never been a “privacy setting” for a deed.

A single property filing can include:

• Full legal names and mailing addresses
• Mortgage balances and lien information
• Signatures and notarization details
• Ownership history and transfer patterns

No toggle in Chrome, Firefox, Safari, or Android settings governs any of it, because none of that data is held by Google, Apple, or a browser vendor. It sits across roughly 3,000 individual county governments in the United States, each running its own portal, with wildly inconsistent protections. That patchwork is precisely the environment automated systems have learned to exploit.

How AI and Bots Are Exploiting the Gap

Digitization made county property records easier to access, which was the point. But it also created a vulnerability that public records laws never anticipated: bots, scrapers, and AI systems can now pull enormous volumes of this data at a speed no human clerk could match. Public Records Safety’s research points to Solove and Hartzog’s 2025 paper, “The Great Scrape,” as an early marker of this shift, arguing that mass scraping runs directly against core privacy principles like consent, purpose limitation, and data minimization.

The numbers behind this shift are hard to dismiss:

• A 2025 National Association of Realtors survey found that 63% of real estate professionals were aware of title fraud in the prior 12 months, a figure that climbed to 92% in the Northeast.
• At least 50 state-level legislative proposals addressing public-sector AI risk were introduced during 2025 sessions.
• Colorado’s AI Act takes effect in June 2026, adding another state-level compliance layer.
• First American Title has documented a real transaction involving an AI-generated deepfake participant on a video call, illustrating how synthetic identity fraud is evolving alongside the data that supports it.

County-originated records don’t stay in county hands, either. Commercial pipelines such as ATTOM, CoreLogic, BatchData, and DataTree routinely absorb public filings through bulk sales, open APIs, and vendor agreements, feeding that information into national data products with little downstream oversight. A record that started as a routine deed filing can end up several steps removed from the county that created it, with no way to trace where it went.

Who Ends Up Exposed

The consequences of this gap are not evenly distributed. Some groups face outsized risk:

• Domestic violence survivors, whose relocated addresses can resurface through commercial aggregators even after formal address confidentiality protections are in place.
• Elderly homeowners, particularly those with mortgage-free or high-equity properties, who are frequently targeted for deed fraud.
• All property owners, since bulk data harvesting expands the raw material available for forged signatures and fraudulent transfer schemes.
• Title and records professionals, who still catch the misfiled entries and local quirks that automated systems miss, meaning uncontrolled scraping threatens accuracy as well as privacy.

This is also why “data broker opt out” and “personal information removal” have become searches in their own right, drawing hundreds of monthly queries from people trying to claw back control after the fact. By the time someone searches for removal help, the data has often already been aggregated and resold.

Closing the Gap: What’s Being Done and What You Can Do

The response is starting to catch up with the problem, on two tracks at once. On the policy side, states are experimenting with filing alerts, suspicious-document holds, photo ID requirements, and title-freeze style protections. On the technical side, counties can take concrete steps that function like a public-records version of Global Privacy Control: a documented, standardized way to say “do not scrape this.”

Public Records Safety’s own recommended framework breaks this into five steps counties can move through in order:

1. Awareness – Understand how automated access is already affecting your system.
2. Assessment – Evaluate current exposure and vulnerabilities.
3. Implementation – Apply basic technical protections and policy language.
4. Coordination – Work with vendors, abstractors, and other stakeholders.
5. Ongoing monitoring – Adjust as scraping techniques and threats evolve.

Practical tools already exist to support this, including sample robots.txt language that blocks known AI crawlers while still allowing legitimate search engines, and sample Terms of Use language prohibiting automated scraping without written authorization. Public Records Safety also publishes a Research Briefing, a County Action Guide, and a one-page Fact Sheet so county officials, IT staff, and concerned residents have sourced material ready for board meetings and policy discussions, along with a county lookup tool to check where a specific county currently stands.

The Full Picture of Privacy Controls

None of this is an argument against GPC, browser tracking protections, or locking down your app permissions. Those remain the fastest, most direct way to reduce your exposure to commercial tracking, and they take only a few minutes to set up. But real privacy control, in 2026, has to account for data that lives outside any app or browser entirely.

Public records were built for transparency, not for automated, industrial-scale extraction, and the tools that protect your search history won’t do anything to protect a deed filed decades ago. Closing that second gap depends less on personal settings and more on counties, vendors, and abstractors adopting the same instinct that browsers already have: give people, and their local governments, a real way to say no to bulk automated access.

The most effective privacy strategy right now treats these as two separate but connected tasks. Keep using GPC, browser tracking protections, and device permission reviews to manage what companies collect about your behavior online. Then look one layer deeper, at the records your county already holds, and ask whether anyone is actively protecting them. Until bulk scraping protections become standard practice everywhere, checking where your own county stands is one of the few privacy controls left that actually reaches this part of your data.

Frequently Asked Questions