2Apply was ordered to stop asking renters about citizenship and visa expiry

If you have applied for a rental property in Australia in the last five years, there is a better than one in three chance you filled in a 2Apply form. Somewhere in it, you were asked for your citizenship status and the expiry date on your visa.

On 1 April 2026, the Privacy Commissioner found that question should never have been asked.

The determination is *Commissioner Initiated Investigation into IRE Pty Ltd (Privacy)* [2026] AICmr 24. It covers more than 8.5 million rental applications processed through 2Apply between March 2020 and 18 March 2025. And it found that the operator collected personal information it did not reasonably need, and collected it by unfair means, in breach of Australian Privacy Principles 3.2 and 3.5.

For Indian-Australian renters who have long suspected that visa status was quietly filtering their applications, this is the first time a federal regulator has put the practice on the record and ordered it to stop.

What the Commissioner actually found

Privacy Commissioner Carly Kind listed ten categories of information that 2Apply collected and did not need. Gender. Names and ages of dependants. Student status. Bankruptcy status. Retirement status. Previous living history. Current or intended property ownership. Applications lodged for other properties. Bond and rent assistance status.

The tenth item, listed as paragraph 94(j) of the determination, is “citizenship status and visa expiry”.

The reasoning is worth reading in full, because it is short and it is blunt. IRE argued the information was reasonably necessary to check whether an applicant could uphold a tenancy agreement, including paying rent for the whole lease period. The Commissioner did not accept it. Her finding was that the information “does not establish an individual’s ability to pay rent or the likelihood that the individual will take care of the property”, and that the company could do its job without collecting it.

A second list, at paragraph 95, covers information the platform could collect less of rather than none: emergency contacts, vehicle details, identification documents including passport numbers and Medicare card colour, proof of income and employment details.

The detail almost every report missed

During the investigation, IRE agreed on a without-admissions basis to stop collecting several of the items. Gender went. Student status went. Bankruptcy status went. Property ownership, vehicle details, smoker status and bond claim history all went.

Citizenship status and visa expiry did not. It sits among the six items the company declined to drop voluntarily, alongside retirement status, previous living history, other applications, bond and rent assistance status and emergency contacts. That is why the Commissioner had to order it.

The distinction matters. On the categories a rental platform could most obviously live without, the company moved. On the one that goes to a renter’s immigration status, it held its position until a regulator directed otherwise.

The Commissioner did tie several of these items to discrimination risk directly. On gender, she noted collection “may also increase risks of discrimination in the tenancy application process”. On bond and rent assistance status, she warned it “increases the risk of profiling of vulnerable individuals who are in receipt of social security payments”. She did not make an equivalent discrimination finding on citizenship and visa status. Her reasoning there was narrower, resting on relevance rather than harm.

The first time an Australian regulator has ruled on how a form is designed

This determination did something the OAIC had not done before. It examined the design of the form itself, using the concept of online choice architecture: the way choices are structured, ordered and worded to steer people toward a particular answer.

Two pieces of wording drew the finding. The form told applicants that supplying the information would “help speed up your application process”. It also warned that not supplying it may “affect whether you are considered as a suitable tenant for the property”. Applicants were also required to agree to direct marketing to progress, with the reassurance that they could unsubscribe later, and no way to opt out at the point of collection.

The Commissioner set that architecture against the market renters are operating in. Her finding at paragraph 121 reads: “In the absence of any legislated right to housing, the competitiveness of the current rental market means that individuals are at a disadvantage when trying to rent a home.”

Kind put the same point more plainly in her public statement: “Renters often lack real choice when making rental applications.” She continued that either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss.

What IRE was ordered to do, and by when

The determination made five orders, all running from 1 April 2026.

Within 60 days, so by 31 May 2026, IRE had to stop collecting every item on the paragraph 94 list, and engage an independent privacy expert at its own expense. Within six months, that reviewer must prepare a report covering whether the second-tier information is reasonably necessary, the online choice architecture of the form, and data retention practices. Within 14 days of receiving it, IRE must give the OAIC a copy. Within 12 months, it must report on what it has implemented and give reasons for anything it has not.

No fine was imposed. CHOICE noted the OAIC has power to seek penalties of up to $66,000, and that the outcome here required the company to discontinue the collection without admitting fault.

The Commissioner also expressed an expectation that the rest of the sector would follow: “I expect that other RentTech providers will adapt their practices to be consistent with my findings.” The determination was provided to real estate peak bodies. She additionally congratulated IRE on its participation in and response to the investigation, which is not the language of an adversarial finding.

Nobody has said whether the order was followed

The 60-day deadline passed three months ago. There is no public information about whether IRE complied.

The OAIC’s media centre carries releases spanning 20 May to 7 August 2026, straddling the deadline exactly. It has published on facial recognition, on a major airline breach, on notifiable data breach statistics and on tracking pixels. It has published nothing further on this matter. The company’s product update log for April through July 2026 records form changes required by Queensland, the Northern Territory, South Australia and Victoria, and none required by the Privacy Commissioner. No appeal to the Administrative Review Tribunal has been reported, and the 28-day window for one closed in late April.

[Unverified] Whether IRE ceased the collection by 31 May 2026, and whether an independent reviewer has been engaged, could not be established from any public source. The questions are precise and answerable, and they belong to the OAIC and to the company.

One thing did change. The platform now trades under a different corporate name. The collection statement on 2Apply today opens “Thanks for using 2Apply! We’re Reapit Pty Ltd”, and the linked privacy policy is headed Reapit Lettings, last updated August 2025. The determination names IRE Pty Ltd trading as InspectRealEstate. Which entity now carries the obligations is a fair question to put to the company.

And the direct marketing wording the Commissioner criticised is still live. As at the end of August 2026, the 2Apply collection statement still tells applicants they may be marketed to about other products in the Reapit family, followed by the same reassurance that they will be able to unsubscribe. That wording sits within the review obligation rather than the 60-day cease order, so its survival is not proof of breach. It is the practice the Commissioner named, unchanged four months after the deadline.

What the other platforms ask now

CHOICE identified seven rental application platforms in the Australian market, with 2Apply the most used at 37 per cent of renters, Ignite at 31 per cent and rent.com.au at 19 per cent.

Snug’s published application checklist, updated 4 August 2026, sets out thirteen sections: profile, rental preferences, address history, employment history, income assessment, identity documents, optional background check, pets, supporting documents, personal reference, student details, next of kin and utility connections. There is no citizenship or visa status question. A citizenship certificate and an Australian visa grant are both listed as acceptable 40-point identity documents, alongside many others. Snug does still collect student details as its own section, which is item (c) on the Commissioner’s list.

The renter-facing help material for Ignite and realestate.com.au, updated in the last week of August 2026, documents no citizenship or visa status question either. An overseas passport is accepted as photo identification. In the Northern Territory alone, immigration and citizenship papers appear among acceptable secondary identity documents, and there realestate.com.au removed date of birth and the entire employment section in response to Territory law rather than to the OAIC.

[Unverified] What 2Apply’s live form asks today could not be established. The form sits behind account creation and identity verification, the platform’s help centre does not enumerate its fields, and no product update records the removal. The only documentary record of the question remains the determination’s own attachment, which describes the form as it stood before the ruling.

[Unverified] The fourth platform, tApp, could not be checked at all. Every request to its site returned an empty response.

The evidence that renters were already being asked

The Tenants’ Union of NSW surveyed 124 renters between January and mid-March 2023 about privacy in the application process. Of those, 36.3 per cent reported being asked for or providing visa status. More than half had provided proof of marital status. Almost 92 per cent said they felt pressured into sharing information they were uncomfortable with, and 41.3 per cent had refused to share something and believed they missed out on a property because of it.

That sample is small, self-selected and confined to NSW, so it cannot be read as a national measure. It is, however, the only Australian survey that asks the question directly, and the Commissioner cited the same research in her determination.

CHOICE’s national survey of 1,000 renters found 41 per cent felt pressured by an agent or landlord into using one of these platforms. Sixty per cent were uncomfortable with the amount and type of information collected. Twenty-nine per cent had decided not to apply for a property because they did not trust the platform.

Leo Patterson Ross, chief executive of the Tenants’ Union of NSW, set out why the application stage is where this happens. He described it as an unregulated area with “very light and ineffective discrimination laws that do apply”, and said the questions agents are allowed to ask are “basically unlimited”.

Kate Bower, then consumer data advocate at CHOICE, framed the stakes for renters when the research was released: “People who rent deserve a guarantee that their personal data is safe and isn’t being used to exploit or harm them.” Bower left CHOICE in 2024. Andy Kollmorgen, the organisation’s investigations editor, has written its coverage of the platform since.

Where the law stands, and where it does not

Federal, state and territory anti-discrimination laws already make it unlawful to refuse to rent to someone on the basis of protected personal attributes. The Racial Discrimination Act 1975, the Sex Discrimination Act 1984, the Disability Discrimination Act 1992, the Age Discrimination Act 2004 and each state and territory Act all apply to accommodation.

What they do not do is regulate what an application form may ask before any decision is made. A question that produces a discriminatory outcome is difficult to challenge when the applicant never learns why they were unsuccessful, and when the form itself sits with a third-party platform rather than the agent.

Queensland is the one jurisdiction that has legislated at this point in the process, requiring renters to be given at least two different methods of submitting an application. No other state has done the same.

The practical effect of this determination is narrower than the headline suggests. It binds one company. It creates no right to compensation, imposes no penalty, and does not stop an agent asking the same question by email. What it does establish is that the question is not reasonably necessary, in a written finding by the national privacy regulator, that any renter can now point to.

For a community where a large share of renters are on temporary visas, that is a small piece of ground worth knowing you are standing on. The larger question, whether anyone has checked that the order was obeyed, is still open.

Sources

Every date, figure and quotation in this article is drawn from the sources below. They are listed so you can check the record yourself.

• Office of the Australian Information Commissioner, "Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24"
• AustLII, "IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026)"
• Office of the Australian Information Commissioner, "RentTech platforms must stop unfair and excessive personal information collection, says Privacy Commissioner"
• iTnews, "2Apply raked for dark patterns used to snare renters' data"
• CHOICE, "2Apply ordered to stop demanding excessive renter info"
• CHOICE, "CHOICE RentTech report release"
• CHOICE, "Rental apps and data use"
• Tenants' Union of NSW, "Privacy, data and discrimination in renting"
• Information Age, Australian Computer Society, "Rental platform 2Apply pinged for excessive data collection"
• Hall and Wilcox, "OAIC finds RentTech platform 2Apply interfered with individuals' privacy and collected unnecessary personal information"
• King and Wood Mallesons, "Dark patterns in focus, Privacy Commissioner finds rental tech collection was not fair or reasonably necessary"
• 2Apply, "Personal information collection statement"
• Reapit Lettings, "Privacy policy"
• Snug, "Snug rental application checklist"
• Snug, "100 point check for proof of identity"
• realestate.com.au, "How to upload identity documents for rental applications"
• realestate.com.au, "Rental law changes to application, Northern Territory"
• Office of the Australian Information Commissioner, "Media centre"
• Australian Human Rights Commission, "Housing and accommodation"
• Elite Agent, "A wake-up call, industry braces for impact after 2Apply privacy ruling"