California regulator fines tenant‑screening firm 2Apply over excessive renter data collection

Australia’s privacy commissioner did not fine a California tenant-screening firm. She ruled on April 22 that 2Apply, operated by InspectRealEstate, collected excessive renter data and used unfair collection methods. (oaic.gov.au) The decision came from the Office of the Australian Information Commissioner after a year-long investigation into 2Apply’s rental application platform. The agency said the service breached Australian Privacy Principle 3.2 and 3.5. (oaic.gov.au 1) (oaic.gov.au 2) The regulator said 2Apply collected information that was not reasonably necessary for processing tenancy applications between March 2020 and March 18, 2025. The order says InspectRealEstate must stop repeating those practices and, within 60 days, stop collecting categories listed in the ruling. (oaic.gov.au) Those categories include gender, student status, citizenship status, visa expiry, and details of previous living history, according to the commissioner’s announcement. The company also must hire an independent reviewer at its own expense and deliver a report within six months. (oaic.gov.au 1) (oaic.gov.au 2) The case turns on a basic privacy rule: a company should collect only data it actually needs. The commissioner said renters often face a stark choice between handing over payslips and identity documents or risking losing a home. (oaic.gov.au 1) (oaic.gov.au 2) The ruling also focused on how the form was designed, not just what it asked for. The commissioner said 2Apply used “confirmshaming,” biased framing, and bundled consent to push renters toward disclosures they might not otherwise make. (oaic.gov.au) That makes the decision a test case for rental technology platforms that sit between renters, agents, and landlords. The commissioner said the rental crisis and cost-of-living pressures deepen the power imbalance in those transactions. (oaic.gov.au) California does have an active privacy regulator, the California Privacy Protection Agency, but the 2Apply action in circulation this week is Australian, not Californian. California’s agency has recently brought separate enforcement actions against Honda, Todd Snyder, and data brokers under the California Consumer Privacy Act. (cppa.ca.gov) (cppa.ca.gov) InspectRealEstate agreed to adapt its collection practices on a without-admissions basis, the OAIC said. The order now gives the company 60 days to stop collecting the listed data and six months to document what changes it will make. (oaic.gov.au) (oaic.gov.au)