IRE has 28 days to seek a review of the determination via the Administrative Review Tribunal.

The ruling was informed by AHURI research and media reports highlighting invasive data collection practices and the privacy and security risks facing renters.

The decision specified that 2Apply did not need to collect items such as gender, dependents, student status, bankruptcy status, retirement status, living history, property ownership, other applications, bond or rent assistance, citizenship or visa expiry, and recommended reductions in data like emergency contacts, vehicle details, certain IDs, income and employment documents.

The decision orders 2Apply to stop collecting unnecessary data and signals expectations that other RentTech providers align with these findings; the platform had agreed to adapt practices without admissions.

Australia’s Privacy Commissioner ruled that the RentTech operator 2Apply, run by IRE Pty Ltd, breached two Australian Privacy Principles by collecting far more personal information than necessary and using unfair methods.

The ruling found 2Apply collected excessive data from rental applicants, prioritizing data collection over renters’ privacy.

The investigation highlighted three dark patterns pressuring data sharing: confirmshaming, biased framing promising faster processing if data is provided, and bundled consent for direct marketing to submit the application.

The ruling aligns with ongoing Australian rental reforms in states like Victoria’s standardized application form, South Australia’s Form A1, and Queensland’s two-method application requirement.

There are broad concerns about data security, with past reporting suggesting millions of lease documents could be at risk across several platforms, underscoring the need to limit data collection to what’s necessary for rental decisions.

Samantha Floreani, a digital rights advocate, supported the ruling, noting renters often provide data unrelated to their ability to pay or maintain a property and stressing privacy protection during housing searches.

The ruling signals that ‘dark patterns’ can violate the Privacy Act and may trigger broader regulatory scrutiny of rental platforms and real estate practices.

Commissioner Carly Kind noted renters feel pressured and insecure about withholding information, with data collection extending beyond what landlords and agents need to assess tenants.