Millions of renters hit by unlawful data collection

One of the country’s most widely used rental application platforms collected far more personal information than it needed and used manipulative design tactics to pressure tenants into handing it over.

Privacy Commissioner Carly Kind’s determination, issued on Wednesday after a year-long investigation, found that the operator of the 2Apply platform breached two Australian Privacy Principles by collecting data that was not reasonably necessary for processing rental applications and by collecting it through unfair means.

The platform, which is owned by IRE Pty Ltd has processed more than 8.5 million tenancy applications since its launch in 2020 and is used by real estate agents across Australia, New Zealand and the United Kingdom. Its default application form asked prospective renters for gender, bankruptcy status, citizenship and visa details, student status, names and ages of dependants, two years of living history, vehicle registration numbers and emergency contacts – none of which the commissioner accepted as reasonably necessary.

Kind told this masthead the regulator had examined multiple rental software platforms before zeroing in on 2Apply based on “its impressive market share and revenue, as well as how the platform itself was operating.”

“Renters are really not left with any genuine choice or control over how much information they’re being required to give,” Kind said. “It really is quite an excessive amount of information that’s being asked of renters.”

She said the platforms were “inadvertently or otherwise playing on that insecurity by requiring or enabling or suggesting that individuals hand over all of this information,” noting that renters were “being intimidated in some respects, or at the very least made to feel insecure if they don’t provide enough information.”

The ruling comes as Australia’s rental market reaches crisis levels. The national vacancy rate fell to 1.0 per cent in March 2026, according to SQM Research, with average weekly rents hitting $669 nationally and house rents at record highs in every capital city.

The commissioner’s determination breaks new ground by showing how so-called “dark patterns”, which are manipulative online design strategies to change how users act, could fall foul of the Privacy Act for the first time. Kind found 2Apply employed three manipulative design techniques: “confirmshaming,” where the form warned that withholding information “may affect whether you are considered as a suitable tenant”; biased framing suggesting data provision would “help speed up your application process”; and bundled consent forcing applicants to agree to direct marketing in order to submit their application.

“We really wanted to unpick the ways in which platforms push users into certain choices around their personal information,” Kind said. Renters were “at risk of both having to hand over lots of personal information in a context in which they can’t be sure of the ongoing security of that data, but also in a context in which there is the risk that their application might be unfairly handled.”

Kind said the determination established that while landlords and agents required certain information to assess tenants, “that doesn’t include this kind of lengthy list of other things, which really doesn’t go to those key aspects that real estate agents and landlords need to confirm.”

IRE must cease collecting the prohibited categories of information within 60 days and commission an independent privacy review of the entire platform at its own expense. Kind praised the company’s cooperation, noting it had agreed on a without-admissions basis to stop collecting several categories of data during the investigation. “This is probably the first time that these companies have had this kind of regulatory scrutiny,” she said.

The company was contacted for comment.

Kind said the ruling was intended to reshape data collection practices across the sector, and the determination has been sent to real estate industry peak bodies. She said she wanted the decision to “inform the practices of parties in the ecosystem beyond just the RentTech providers”, including real estate agents, private property managers and landlords.

“We don’t have another investigation in this space underway, but we did look at real estate agents in our privacy sweep that took place earlier in the year,” Kind said. “So there’s likely to be some more decisions in this sector in the next period of time.”

The ruling lands amid a wave of state-level rental reform. Victoria introduced a mandatory standardised application form in March restricting what agents can ask. South Australia’s prescribed Form A1 took effect in January, while Queensland already requires agents to offer at least two application methods, one of which cannot be a third-party platform.

IRE has 28 days to seek review of the determination through the Administrative Review Tribunal.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.