Renters privacy: Protecting your information

You find a rental you love and click on the link to apply. Within minutes, you are asked to hand over information that should make you think twice about renters privacy.

It’s not just your name, employment and references these rental apps are asking for, however. They want to know things like your children’s names and ages, your citizenship status and whether you have been bankrupt. With so much competition for housing, though, it seems few argue before handing it all over.

A landmark ruling by the Office of the Australian Information Commissioner (OAIC) should change that. The OAIC recently issued a privacy determination against InspectRealEstate (IRE), the operator of 2Apply – one of the most widely used rental apps in Australia with over 8.5 million applications as of March 2025 – saying the platform “collected excessive personal information and by unfair means”.

The ruling, which required the company to cease collection of information deemed unnecessary, confirmed what renters and advocates have long been arguing: just because a platform asks for certain information does not mean it is entitled to collect that information.

Why are rental apps in the firing line?

The Privacy Commissioner began the investigation into IRE in March 2025, after consumer advocates raised concerns about RentTech platforms, including 2Apply, and the amount of personal information renters were being asked to provide.

There was also increasing concern about the security vulnerabilities of these platforms, with millions of documents containing personal information openly exposed online.

 

 

The OAIC said the rental sector was chosen as a regulatory priority because of the significant power imbalance between renters and real estate agents, property managers and landlords. This imbalance has intensified in a time of rental shortages, rising rents and cost-of-living pressures.

“As an intermediary to individuals’ access to housing, this power imbalance also favours platforms such as 2Apply,” Privacy Commissioner Carly Kind said.

Renters are in such a vulnerable position that they often think they have no choice when a platform asks them to upload certain documents or provide sensitive information.

What information breached privacy?

The Commissioner found that IRE contravened Australian privacy laws by collecting personal information that was not reasonably necessary for its functions. These included:

• • Gender
  • Name and ages of dependants
  • Student status
  • Bankruptcy status
  • Retirement status
  • Previous living history
  • Whether the applicant owned or intended to own property
  • Current applications for other properties
  • Bond and rent assistance application status
  • Citizenship status and visa expiry date

The Commissioner also found that IRE could collect less information in relation to other areas, including emergency contacts, vehicle details, identification documents, proof of income documents, and employment details.

One of the most important principles from the determination is that distinction between information that might be useful to a landlord and information that is reasonably necessary to assess a rental application.

The Commissioner was clear: just because it is convenient to collect all that information does not make it right. The law requires data collection to be limited to what is genuinely needed. A visa expiry date, bankruptcy history or the names of your children go well beyond that.

 

 

What choices do renters have?

The OAIC recognised that renters do not usually get to choose the platform they use. The choice is usually made by the real estate agency. In some cases, renters are refused alternative ways to apply.

When consumer advocates CHOICE surveyed 1000 renters, they found 41 percent felt pressured by their rental agent or landlord to use RentTech platforms such as 2Apply, Ignite, Snug or tApp.

This is important because consent becomes questionable when a person is effectively told to use the platform or miss out on a home.

“Either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss,” Ms Kind said.

“This not only places them at risk that their applications will not be considered fairly and equitably, but that their personal information may be compromised in a data breach or cyber attack.”

What tactics do rental apps use?

In an OAIC first, the Commissioner also looked at the platform’s online choice architecture – the way the form is designed, what choices it presents and whether the design pressured people into giving more information than they normally would.

They found that 2Apply used manipulative design tactics, including:

• • Confirmshaming – the use of emotive language to make the renter feel guilty or embarrassed for not taking an action that is beneficial to those collecting information
  • Biased framing – presenting choices in a way that emphasises their supposed benefits or downsides
  • Bundled consent – asking renters to provide consent to use their information for multiple purposes in a single request.

The form might include statements such as “not providing the requested information may affect whether you are considered a suitable tenant”.

 

 

“These statements are not necessarily untrue or misleading,” Ms Kind said. “However, by presenting these messages to individuals, my view is that the respondent is employing language that suggests that the volume and type of personal information provided is an indicator of their suitability as a tenant."

How does this affect rental platforms?

The OAIC was clear that RentTech platforms are more than middlemen and have their own obligations under the Privacy Act. It also said other RentTech providers should adapt their practices to be consistent with its findings against 2Apply.

These means platforms (and the real estate agencies they represent) should be reviewing:

• • What information they collect
  • Why they collect it
  • If all that information is needed in the application
  • If unsuccessful applicants’ information is deleted or retained
  • If renters are being pressured by the way their forms are designed
  • If marketing consent is genuinely optional

The OAIC’s decision required IRE to stop the acts and practices found to interfere with privacy and to take specified steps to address the issues. The OAIC said that IRE agreed, without admissions, to adapt its personal information collection processes.

 

 

How does this affect renters?

If a rental app is asking for more than you think it should be, trust your instincts and take practice steps to protect your rental privacy data.

Start by checking all the fields marked mandatory and those that are genuinely optional. Take screenshots of the form before you start, including any prompts suggesting your application will be stronger if you provide more information. Then ask in writing (preferably directly to the real estate agency, rather than the platform):

• • Why is this information required to assess my application?
  • Can I provide a less intrusive document or redact irrelevant information?
  • Is there another way I can apply?

If you don’t get a satisfactory response, you can complain directly to the platform. Ensure your complaint is in writing, reference the OAIC’s 2Apply determination, and state the outcome you want. Give them 30 days to respond.

If unresolved, you can escalate to the OAIC, which investigates breaches of the Australian Privacy Principles and can demand remedial action or compensation.

Renters should not have to trade their privacy for a better chance of finding a home.