Landmark privacy determination puts rent tech platforms on notice. But renters remain vulnerable

One of Australia’s most-used tenancy application platforms has breached privacy laws, Privacy Commissioner Carly Kind has ruled.

2Apply, owned by InspectRealEstate, is a third-party platform that has processed more than 8.5 million tenancy applications.

The commissioner launched an investigation into 2Apply in March last year. In a landmark determination published this week, she found that over a five-year period, 2Apply had interfered with consumers’ privacy by collecting unnecessary personal information via unfair means.

The landmark determination puts the booming rent tech industry on notice, and will help protect renters’ rights. But it must be complemented by further legislative reform.

An expanding industry

The rental technology – or rent tech – market has been expanding.

Rent tech platforms are websites or mobile apps designed to facilitate one or more aspects of the rental process – such as submitting maintenance requests, paying rent, or conducting digital inspections.

There are many different rent tech platforms. Released in March 2020, 2Apply is one of the most commonly used.

Collectively, these platforms have drawn considerable scrutiny due to the amount of personal data they ask renters to hand over.

In 2023, the National Cabinet committed to strengthening the protection of tenants’ personal information. However, progress has been slow.

In research published in January, my colleagues and I found that application platforms enabled real estate agents to request more than 50 types of information.

There’s also evidence some applicants have been asked for marriage certificates and credit information, while others report being asked to prepare CVs for their pets.

Breaching privacy principles

The Privacy Commissioner found 2Apply had breached two of the Australian Privacy Principles.

One of these principles (3.2) says that entities to which the Privacy Act applies must not collect personal information unless it’s reasonably necessary for their functions or activities.

The commissioner identified the processing and management of tenancy applications as 2Apply’s core operations. She considered what types of personal information would be reasonably necessary for these purposes. She found that certain personal information – including gender, rent and bond assistance status – did not meet this threshold.

This determination will be difficult for other rent tech platforms to ignore.

Significantly, the commissioner acknowledged the collection of such information could increase the risk of discrimination against applicants. Although there is growing evidence of discriminatory algorithms in the private rental sector, proving that discrimination has occurred can be challenging.

Minimising the amount of information collected is essential to minimising the risk of discrimination occurring in the first place.

The second principle (3.5) requires that personal information is collected only by fair and lawful means.

The commissioner assessed whether 2Apply had followed this principle with reference to what’s known as “online choice architecture”, taking into account the design, structure, and way information was conveyed through 2Apply’s digital application form.

She deemed 2Apply’s use of certain tactics was unfair.

One of these tactics is known as biased framing. This refers to the practice of presenting choices in a way that emphasises their supposed benefits or downsides so as to encourage consumers to act in ways that will benefit the business – not necessarily themselves.

For example, the 2Apply form says providing personal information will “help speed up your application process”. Conversely, it also says not providing the information may “affect whether you are considered as a suitable tenant for the property”. The commissioner said these statements, while not necessarily untrue or misleading, suggest the volume and type of personal information provided are indicators of an applicant’s suitability as a tenant.

Tactics like this haven’t been adequately addressed by existing consumer protections, despite ample evidence of digital platforms being designed to manipulate or place undue pressure on consumers.

A bill currently before federal parliament is intended to address unfair trading practices that manipulate or unreasonably distort consumers’ decision-making practices. But it’s noteworthy the commissioner deployed the Privacy Act to address these harms.

The commissioner also found the circumstances in which 2Apply collects personal information are characterised by significant power imbalances, limited choice and security risks relating to the real estate sector. She added:

In the absence of any legislated right to housing, the competitiveness of the current rental market means that individuals are at a disadvantage when trying to rent a home and are more vulnerable.

The commissioner directed 2Apply to stop collecting unnecessary personal information within 60 days. She also required that the platform must appoint an independent privacy expert to review its practices.

The Conversation contacted InspectRealEstate for comment.

Systemic change is needed

The commissioner emphasised the need for other rent tech providers to improve their privacy practices.

But there is a risk these providers won’t heed this advice. More needs to be done to protect renters’ rights.

The Privacy Act’s protections must be strengthened. They must also be complemented by robust laws at the state and territory level that are specifically targeted at the rental tech sector.

Some jurisdictions – including Queensland, South Australia and Victoria – have taken the first steps towards strengthening the protection of renters’ personal information under residential tenancies law. Other jurisdictions must follow.

A promising bill is currently awaiting debate and passage in NSW. If legislated, it could offer some of Australia’s strongest protections.

But after being introduced in June 2025, it appears to be in limbo, leaving NSW renters without adequate safeguards.