Victoria’s rental application reforms took effect in March, establishing a standard form that limits what agents and landlords can request from prospective tenants. The rules were designed to stop over-collection of personal data during the rental process, identity verification and ability to pay rent, nothing more.
Six months in, the Consumer Policy Research Centre has found platforms working around the constraint. They’re not breaking the letter of the law; they’re encouraging renters to volunteer information outside the formal application process, where the standard form doesn’t apply. Mock rental applications and interviews with Victorian tenants show platforms prompting users to share details the law explicitly ruled out, framed as optional or beneficial to the applicant’s chances.
How the workaround operates
The standard form covers what agents must use for the actual rental decision. Platforms host that form, but they also run adjacent features, profile pages, pre-application questionnaires, ‘verified renter’ badges, that sit outside the statutory process. A tenant filling out the mandatory form might then be nudged to complete a separate section ‘to stand out’ or ‘speed up future applications’.
That’s where the excess data flows in. Employment history beyond what’s needed for income verification, previous rental references with subjective ratings, even behavioural screening questions that wouldn’t pass muster on the standard form, all presented as voluntary, all stored by the platform.
The legal constraint applies to what the agent requests. The platform is a third party. If the tenant volunteers the information to the platform rather than being asked for it by the agent, the reform’s scope doesn’t clearly reach it. That’s the grey zone.
The data trail and who sees it
RentTech platforms don’t just store application details for a single tenancy. The CPRC review found privacy policies allowing data sharing with debt collectors, credit providers, background check vendors, and marketers of financial products. Once a platform holds the information, the tenant has limited visibility into who accesses it or how it’s used in future rental decisions.
A tenant applying for multiple properties via the same platform builds a cumulative profile. Employment gaps, previous disputes with landlords, even the fact that someone applied for ten properties in a fortnight, all potentially visible to agents using that platform, even if none of it appears on the standard form for the current application.
One platform was found by the privacy commissioner in April to have collected unnecessary personal information via unfair means over five years. That case resulted in enforceable undertakings, but it also confirmed the pattern: platforms accumulating data beyond what the rental transaction requires, with weak constraints on downstream use.
Key numbers
- Victorian reforms took effect March 2026, capping agent requests to identity and income verification
- Six RentTech platforms reviewed by CPRC between November 2025 and March 2026
- NSW and SA ban fees for background checks but still allow platforms to request them
- One major platform found by the privacy commissioner to have breached collection rules over a five-year period
The enforcement question
Victoria’s standard form is enforceable against agents and landlords. Breaches carry penalties. But the voluntary-disclosure model creates a compliance gap. If a tenant feels pressured to complete a platform profile to improve their chances, and the agent never directly requested that information, who’s accountable?
The platform will point to consent boxes and privacy policies. The agent will note they only used the standard form. The tenant, facing a vacancy rate under 2 per cent in inner Melbourne, won’t risk lodging a complaint that might flag them as difficult.
Consumer advocates argue the power imbalance makes any ‘voluntary’ disclosure inherently coercive in a tight rental market. Platforms counter that renters benefit from reusable profiles and faster applications. Both are true. The question is whether the benefit to the renter outweighs the risk of aggregated data being used against them in ways they can’t see or contest.
No state has yet extended rental application rules to cover platform-hosted voluntary disclosures. Victoria’s reforms are the strongest in the country, and they still leave this gap. NSW and SA prohibit charging tenants for background checks but allow platforms to request them. Queensland, WA and Tasmania have no equivalent restrictions at all.
Scenarios for the next twelve months
Base case: Platforms continue the voluntary-disclosure model, regulators issue occasional guidance on ‘unfair means’ under existing privacy law, no legislative fix. Tenants in tight markets keep oversharing to compete, data accumulation continues, breaches surface when a platform is hacked or a dispute goes public.
Upside: Victoria extends the standard form rules to cover platform-hosted questions and profiles, other states adopt similar reforms, the privacy commissioner gains audit powers over RentTech operators. Enforcement becomes proactive rather than complaint-driven.
Downside: Platforms respond to any tightening by shifting data storage offshore or restructuring as pure software providers rather than data custodians, putting their operations outside Australian privacy law’s effective reach. Tenants lose even the nominal protections they have now.
The broader RentTech pattern
The data-collection gap is one pressure point in a sector that’s consolidated quickly with limited regulatory catch-up. The same platforms run screening algorithms, tenant ‘rewards’ schemes tied to on-time rent payments, and referral systems for insurance and utilities, all feeding back into the tenant’s profile.
Screening tools, in particular, raise fairness questions. If an algorithm flags a tenant as higher-risk based on postcode, previous rental churn, or employment type, and that score is shared with agents outside the standard application process, the tenant has no visibility into why they’re being passed over. The Victorian reforms don’t touch algorithmic decision-making; they only limit the inputs an agent can formally request.
Industry groups argue RentTech improves efficiency and reduces fraud. Both are true. The cost is a rental market where every application builds a persistent, opaque data file that follows the tenant across properties and years, with no expiry and limited correction rights.
Practical steps if you’re renting in Victoria
Complete the standard rental application form in full, that’s mandatory and protected. Treat any platform prompt for additional information as optional, because it is. Ask the agent directly whether completing a platform profile improves your chances; if they say yes, that’s evidence the voluntary model isn’t truly voluntary.
Request a copy of your data from the platform annually under privacy law. Check what’s stored, how long it’s retained, and whether there are inaccuracies. If you spot a mistake, a previous rental dispute mischaracterised, employment dates wrong, lodge a correction request in writing.
If you’re in NSW, SA, Queensland, WA or Tasmania, the voluntary-disclosure risk is higher because there’s no standard form constraint at all. Limit what you share to what’s needed for identity and income verification. Anything beyond that is a trade-off between standing out in a competitive market and reducing your long-term data exposure.
For policymakers and regulators watching this unfold: the gap between formal application rules and platform-encouraged voluntary disclosure is a design flaw, not an edge case. Fixing it requires either extending the standard form rules to cover any platform-hosted rental-related data collection, or giving the privacy commissioner explicit audit and enforcement powers over RentTech operators. Waiting for breaches to surface complaint by complaint leaves tenants bearing the risk.
Subscribe to the newsletter for weekly updates on rental regulation, housing policy and market shifts that affect renters and investors.
General info, not financial advice.
