Australian Rental Apps Accused of Harvesting Tenant Data Beyond Victorian Privacy Laws
A consumer watchdog review found so-called RentTech platforms asking hopeful renters for far more personal information than new Victorian rules allow, raising questions about how easily the protections can be sidestepped.
Key points
- The Consumer Policy Research Centre (CPRC) found multiple rental technology platforms collecting tenant data in volumes it described as "excessive".
- Some platforms asked for personal details "completely outside" new Victorian laws meant to limit what landlords and agents can demand from applicants.
- Researchers say the platforms may be dodging the rules by gathering information before or outside the formal rental application process.
- No specific record counts or data breach has been reported; the concern is routine over-collection, not a one-off hack.
Renting a flat in Victoria just became legally safer, in theory. New state rules restrict what landlords and property agents can demand from people applying for a rental property. But a review by the Consumer Policy Research Centre, an independent Australian research body, suggests some rental technology companies, widely called "RentTech" platforms, have found a workaround.
What did the review actually find?
Several platforms encouraged applicants to hand over personal information that goes well beyond what the new rules permit, and some requests arrived outside the formal application process entirely, a gap the Victorian rules appear not to cover.
Two specific problems emerged. The sheer volume of information some platforms requested was judged "excessive," going further than any reasonable screening need could justify. And some questions were "completely outside" the new rules, covering categories of personal detail the legislation was written precisely to stop landlords from demanding.
Asked outside the formal process, that information falls into a regulatory grey area. The Victorian rules govern the rental application itself. A platform that collects data at a different stage, say a sign-up profile or a pre-application verification step, may technically sit beyond the law's reach.
Why does this matter for ordinary renters?
Over-collection is a real privacy risk even without a hack. When a company holds more of your personal information than it needs, that data can be retained, sold to third parties, or exposed if the platform suffers a security incident later.
Renters in a tight housing market face particular pressure: refusing to share information could mean losing a property to someone who simply clicked "yes." That power imbalance makes meaningful consent difficult, a point regulators in multiple countries have flagged. We first covered the tension between Australian privacy frameworks and data-hungry platforms on 12 September 2026, when NDIS participants' records were potentially shared with a US analytics company through a government anti-fraud program.
The relevant Australian regulator is the Office of the Australian Information Commissioner, known as the OAIC, which oversees the Privacy Act 1988. Whether the OAIC or Victorian state authorities take enforcement action following the CPRC findings isn't yet clear. Guardian Australia first reported the review's conclusions.
| What the rules cover | What the CPRC found some platforms doing |
|---|---|
| Information requested during a formal rental application | Collecting data before or outside the formal application stage |
| Specific permitted categories of personal detail | Requesting categories explicitly excluded by the new rules |
| Landlord and agent conduct | Platform conduct, which may fall in a regulatory gap |
Should you worry if you're a Victorian renter?
You have the right to ask why each piece of information is needed and what it will be used for. You can decline to answer questions that feel irrelevant to assessing your tenancy, though a landlord or platform may proceed without your application.
Check whether a platform has a published privacy policy. If it doesn't, or if the policy is vague about who receives your data, think twice before you upload identity documents. Complaints about data handling can be directed to the OAIC at oaic.gov.au.
The blunter read: the Victorian rules were written to protect renters, but they were written for landlords and agents, not for the software layer sitting underneath them. Until that gap is closed, the protections are real on paper and porous in practice.
