How to fix your rental application form after the 2Apply decision
On 1 April 2026 the Privacy Commissioner found that the 2Apply rental-application platform (Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24) collected personal information that was not reasonably necessary, breaching APP 3.2, and collected it by unfair means, breaching APP 3.5, and gave IRE 60 days to stop collecting ten named categories. To fix your form, stop asking for fields you cannot justify, take the pressure out of the framing, and know a platform does not move the obligation off your agency.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What did the 2Apply decision actually find?
In Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24, decided 1 April 2026, Privacy Commissioner Carly Kind found that IRE Pty Ltd, trading as InspectRealEstate and operating the 2Apply platform, collected personal information that was not reasonably necessary for its functions or activities, breaching APP 3.2, and collected it by unfair means, breaching APP 3.5. It was the first time the Commissioner weighed an entity's Online Choice Architecture, or dark patterns, in deciding whether a collection was fair. The OAIC's APP 3 guidelines cite the determination at paragraph 3.28 and record that it is under review in the Administrative Review Tribunal. You can read it on the OAIC website and the OAIC's statement of 22 April 2026, RentTech platforms must stop unfair and excessive personal information collection.
The Commissioner said so twice, in terms:
"considers, for the first time, an entity's Online Choice Architecture" · [2026] AICmr 24 at [7]
"this is the first time I have done so in the context of APP 3.5" · at [111]
Plenty of law-firm commentary explains the case. Far less tells an agency what to change on Monday. The rest of this page is the practical fix.
Which fields should you stop asking for?
At [80] the Commissioner set out what a tenancy application may ask for: information that establishes the individual's identity and contact details, their ability to pay the rent, or whether they are likely to appropriately maintain the property. At [94] she named ten categories IRE could do without, and declared it must stop collecting them within 60 days. Run your own form against those three limbs, field by field.
- Gender, and the names and ages of dependants. Neither establishes ability to pay or care of the property, and both carry discrimination risk [83].
- Student status, bankruptcy status and retirement status, none of which adds anything to evidence of income [83].
- Citizenship status and visa expiry, treated as one category, establishing neither ability to pay nor care of the property [83].
- Current applications for other properties, and bond and rent assistance application status, which the Commissioner said risks profiling applicants on social security [83].
- Details of previous living history, and current or intended ownership of a home or investment property. A referee's name and contact details do the reference check instead [83].
The safer default is the three limbs at [80]: identity and contact details, ability to pay the rent, and whether the applicant is likely to look after the property, tested through referees rather than a two-year living history. At [85] the Commissioner pointed to a secure third-party verification service, or sighting documents, as less intrusive ways to establish identity.
Which dark patterns should you remove?
The unfairness finding was cumulative: at [120] it rests on all the circumstances at [110], the power imbalance, the lack of real choice, the excessive collection and the design of the form. Online Choice Architecture was, at [111], "but one of the many factors". These are the patterns the Commissioner named.
- Confirmshaming. At [118] the wording that did it was the form saying that giving the information would "help speed up your application process" and that withholding it may "affect whether you are considered as a suitable tenant for the property". Check your own form for lines like those.
- Biased framing, where optional data is presented as required, or the "share more" choice is visually pushed over the minimal one.
- Bundled consent, where one tick covers several unrelated uses, so an applicant cannot agree to the tenancy assessment without also agreeing to marketing or data-sharing.
- The test for every optional field: if an applicant leaves it blank, does anything on the page suggest their application will be treated less favourably? That is the pressure the Commissioner picked out at [118], and it does not need a pre-ticked box to exist.
Consent that is bundled or manufactured is not freely given, which is why the design of the form, not just its field list, is part of getting collection right.
At a glance
| Fix | APP | What to do |
|---|---|---|
| Stop excessive fields | APP 3.2 | Remove all ten categories at [94], from gender and dependants to bond assistance and visa expiry |
| Apply the necessity test | APP 3.2 | Keep only identity and contact, ability to pay the rent, likely care of the property [80] |
| Remove dark patterns | APP 3.5 | Strip the three named at [113]: confirmshaming, biased framing, bundled consent |
| Unbundle consent | APP 3.5 | Separate tenancy assessment from marketing or data-sharing |
| Give a proper notice | APP 5 | Provide a collection notice at or before collection |
| Own the obligation | APP 3, 5 | The agency stays responsible even on a third-party platform |
Does using a platform move the obligation off your agency?
Your agency chooses the platform, the fields and the framing. At [110] the Commissioner recorded that an applicant "cannot choose which rental platform to use" because "this choice is made by the real estate agent", and at [90] that IRE's agent customers could ask for extra fields to be added. The finding was against the platform operator and not against any agency, but at [10] she encourages "RentTech providers and real estate agents to turn their minds to the privacy of tenancy applicants", and at [9] said the determination would go to the real estate peak bodies. Where the Privacy Act applies to your agency, what a platform gathers on your form is information you have collected, so turning fields off or pressing the vendor is your call.
What should you do now?
Audit your rental application field by field and delete anything you cannot tie to a genuine, reasonably necessary purpose. Then fix the framing so no optional field is disguised as required and no consent is bundled. Finally, pair the form with a proper collection notice under APP 5, given at or before collection, not buried in a policy no one reads. The APP 5 collection notice guide shows what the notice must cover.
Privaproof gives you an educational free self-audit to see where your current form stands, and a living Kit with a done-for-you application form and collection notice kept current as guidance changes, so you meet your obligations without drafting the wording yourself.
Common questions
Which rental application fields did the 2Apply decision flag?
At [94] the Commissioner found the respondent could undertake its functions or activities without collecting ten categories: gender; details of dependants, specifically names and ages; student status; bankruptcy status; retirement status; details of previous living history; current or intended ownership of a principal place of residence or investment property; current applications for other properties; bond and rent assistance application status; and citizenship status and visa expiry. Two more, smoker status and bond history and claims, were left undecided at [84] because IRE had already agreed to stop collecting them. The safer default is the three limbs at [80]: identity and contact, ability to pay the rent, and likely care of the property.
Does using 2Apply or another platform make me compliant?
No. Using a platform does not move the obligation off your agency. You choose the fields and framing, so you stay responsible under APP 3.2 and APP 5 for collecting only what is reasonably necessary and giving a proper collection notice. Vet the platform and turn off fields you cannot justify.
What is a dark pattern on a rental application?
A dark pattern is deceptive design that pushes applicants to share more than they need to. Examples include confirmshaming, presenting optional fields as required, bundled consent and pre-ticked boxes. The 2Apply decision treated this kind of design as unfair means of collection under APP 3.5.
Was the agency or the platform penalised in the 2Apply case?
Neither was penalised. A determination cannot impose a fine: s 52 has no penalty limb, and a civil penalty needs a court order on the Commissioner's application (ss 13G, 80U). IRE received declarations instead: stop collecting the ten categories within 60 days, engage an independent privacy reviewer at its own expense, give the review report to the OAIC, and report at 12 months on the recommendations. The OAIC's APP 3 guidelines record the determination as under review in the Administrative Review Tribunal.
This is general information, not legal advice. Privaproof provides tools and general information; it is not a law practice. Sources: Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24, 1 April 2026, on the OAIC website; OAIC RentTech statement, 22 April 2026; OAIC APP Guidelines chapter 3, which cites the determination at paragraph 3.28 and records it as under review in the Administrative Review Tribunal; Australian Privacy Principles 3 and 5, Privacy Act 1988 (Cth).