In this article
Kooky
Builder of Shaka, the payment router that pays every agent their commission on closing date.
About Kooky and Shaka →A property manager opens the applications for a two-bedroom unit and finds forty of them. They are not in the order they arrived. The software has arranged them, and beside each name sits a marker: a percentage, a row of stars or a coloured label. The manager has perhaps an hour for the whole file, so the top of the list gets read first. For the applicants, everything now depends on a sorting that none of them saw and few of them know exists.
This guide looks at that sorting. It explains how application platforms rank or score people, what is and is not publicly known about the methods, and which rules reach them in Queensland: the tenancy law limits on what an applicant may be asked, the Anti-Discrimination Act 1991, the tenancy database provisions, and the national Privacy Act as applied in a determination the Privacy Commissioner made on 1 April 2026. It is a description of the rules as published, not advice on any one application.
Privacy Commissioner's determination [2026] AICmr 24 of 1 April 2026 (the figure is "over 8.5 million"); Residential Tenancies Authority page on the application process.
How a platform turns an application into a rank
"RentTech" is the usual name for the software that sits between a person looking for a rental and the agency letting it. An application platform collects the applicant's details and documents once, then sends them to the agent for each property applied for. Screening is the step after collection: checking what was submitted, comparing applicants and presenting them in an order.
The mechanisms differ in ambition. The simplest is a completeness measure, which counts how many fields and documents an applicant has supplied. The next is rule-based filtering, such as comparing the declared income with the weekly rent. Beyond that lie scores that combine several inputs into one number. In a report released on 17 April 2023, titled "At what cost? The price renters pay to use RentTech", the consumer group CHOICE said automated decision-making systems were becoming an increasingly common part of rental application systems, and described platforms giving landlords tools to screen prospective tenants on income, employment status, lifestyle and other criteria.
Related readA rent figure from software: what Queensland's Act asks before it runsWhat the pages read for this guide do not contain is a published formula. CHOICE's article on its report names several platforms but does not set out how any of them builds a score or which factors weigh most. That gap is part of the subject. An applicant can be ranked by a method the applicant cannot inspect.
What renters told CHOICE
The CHOICE report rested on a national survey of renters. The article announcing it does not state the sample size, so the figures below should be read as the proportions CHOICE reported in April 2023, across Australia and not for Queensland alone.
CHOICE, article of 17 April 2023 on its report "At what cost? The price renters pay to use RentTech". The last row is a share of renters aged 18 to 34; the others are shares of all renters surveyed.
Two of those rows bear directly on scoring. Roughly one young renter in five said a tenant score had been used to assess an application, which shows the practice was already familiar three years before this guide was written. And a quarter of renters had paid for a tenancy check, a product that some platforms offer to applicants as a way of strengthening a file. Queensland's rules on that point are covered below.
The Queensland form that narrows what can be scored
A score can only be built from what the software holds. Queensland tenancy law limits that at the source, by controlling what an applicant may be asked.
The Residential Tenancies Authority, the state body known as the RTA, explains on its application process page that property managers and owners must use the standard rental application, Form 22 for general tenancies and Form R22 for rooming accommodation, or a form of their own that complies with the Residential Tenancies and Rooming Accommodation Act 2008. The RTA lists the information that can be requested and the information that cannot.
Related readVirtual staging and AI-edited photos: what the law allows| Subject | May be requested | May not be requested |
|---|---|---|
| Rental history | Previous tenancy agreements, referees | Notices to remedy breach, bond claim history |
| Disputes | Nothing listed | Legal action or dispute evidence, including tribunal matters |
| Money | Employment and income, ability to pay the rent | Credit account statements, bank transaction details |
| Household | Number of occupants and how many are under 18, vehicles, pets | Nothing listed |
| Identity | Name, date of birth, phone and email details | Keeping a copy of a sighted document without consent |
Requesting prohibited information carries a maximum of 20 penalty units, according to the RTA. Community housing and state housing providers are exempt from the form requirement.
Supporting documents are limited as well. The RTA says a manager may ask for up to two documents in each of three categories: proof of identity, evidence of ability to pay the rent, and material going to suitability for the property. Bank statements may be offered as evidence of income, but without transaction details. An applicant may hand over more of their own accord. The manager may accept it, the RTA's fact sheet for property managers says, provided the extra material was not requested, encouraged or solicited.
That last phrase is where a completeness score meets the law. A meter that rises as more documents are uploaded, shown to the applicant with a suggestion that a fuller file does better, is hard to describe as neutral about whether more should be supplied. The RTA's pages do not discuss scores or meters, and no ruling on the point was found for this guide. The rule they state is that anything beyond two documents per category must be the applicant's own idea.
One detail on the RTA's page deserves care. It says the restrictions on what can be requested from the applicant do not extend to questions put to a referee the applicant has nominated, including questions about legal action, breach notices and bond history. So information barred from the form can still reach the file through a reference.
Two ways to apply, one of them outside the platform
The second Queensland rule goes to whether an applicant has to be scored by a platform at all. The RTA states that a property manager or owner must give applicants at least two different ways to submit an application, and that one of them must not be restrictive.
Related readAgency chatbots and tenants: what an automated reply cannot doA method is restrictive, on the RTA's description, if it requires the applicant to provide personal information through an online platform to a third party that is not the agent, or if it requires the applicant to pay, whether as an application fee or as the cost of a background check. Sending the application directly to the property manager or owner, by email for instance, is given as a non-restrictive method.
In practice this means a platform can be offered but cannot be the only door. It also means the paid check cannot be made a condition. An applicant who uses the direct route is still assessed, but by whatever process the agency applies to a form that arrived by email. Whether such an application is later keyed into the same software, and scored there, is not something the RTA's pages address.
The RTA's fact sheet also sets a time limit that applies to every applicant who misses out. Personal information about unsuccessful applicants must be destroyed within three months of the start of the successful tenant's agreement. For tenants, the fact sheet gives seven years from the end of the agreement, for agreements on foot on or after 1 May 2025. A score calculated from an application is derived from that personal information, and the pages read here give no reason to treat it differently.
What the Privacy Commissioner found in April 2026
The most detailed public examination of an application platform is a determination made by the Privacy Commissioner, Carly Kind, on 1 April 2026 and published by the Office of the Australian Information Commissioner under the citation [2026] AICmr 24. The respondent was IRE Pty Ltd, trading as InspectRealEstate, and the product was its tenancy application platform, 2Apply. The Commissioner opened the investigation on her own initiative on 18 March 2025 and examined the period from March 2020 to that date. The determination records that the platform had processed more than 8.5 million applications. It also records that the small business exemption in the Privacy Act did not apply, because the company's turnover was above the $3 million threshold.
Related readAI-drafted condition reports: what Queensland tenancy law still asksTwo breaches of the Australian Privacy Principles were found.
The first concerned necessity. The principle on collection allows an organisation to collect personal information only where it is reasonably necessary for its functions or activities. The Commissioner found the platform had collected information that did not meet that test, and listed ten kinds that it must cease collecting: gender; the names of dependants, as opposed to their number and ages; student status; bankruptcy status; retirement status; two years of previous living history; whether the applicant owned a home or an investment property; current applications for other properties; whether the applicant had applied for bond or rent assistance; and citizenship status and visa expiry. A further group was found to be collected in excess, including the details of a person to call in an emergency, vehicle details, identity document numbers, proof of income and employment particulars. A theme of the reasoning was timing: information needed only from the person who gets the tenancy had been collected from everyone who applied.
The second breach concerned fairness. Collection must be by fair means, and the Commissioner found it was not, taking the circumstances together: the imbalance of power between applicants and the agents, landlords and platforms on the other side, the pressure of the rental market, and the limited choice applicants had about which platform to use. The determination then examined the design of the form itself, which it describes as online choice architecture, and it notes that this was the first time such design had been considered under the Privacy Act. Three features were identified. The form said that supplying information would help speed up the application while leaving it out might affect whether the applicant was considered suitable. The messages stressed the benefits of providing information without mentioning any downside. And consent to direct marketing was bundled into the application, with no way of declining at that point.
Related readAI suburb forecasts and growth scores: what an agent may pass onOn scoring, precision matters. The determination refers to the form's treatment of how complete an application is, in the context of those design findings. It does not contain a separate ruling on scores or rankings, and it did not examine tenancy database checks or paid background checks. Data retention was expressly left outside its scope. So the decision speaks to what a platform may gather and how it may nudge people to give it. It leaves open what a platform may calculate from the result.
What the platform was ordered to do
The Commissioner recorded that the company had cooperated, and that it had been willing to stop collecting several kinds of information, without admissions, after receiving the preliminary findings. The orders then set a timetable, summarised here from the published determination.
- Within 60 daysStop collecting the ten listed kinds of information, and engage an independent privacy expert at the company's own expense.
- Within six monthsThe reviewer reports on what is reasonably necessary at each stage of an application, on the form's design and on retention.
- Within 12 monthsThe company reports to the regulator on how it has acted on the recommendations, or explains why it has not.
The determination also requires the reviewer's report to be given to the regulator within 14 days of the company receiving it. The pages read for this guide do not show what has been done under the orders since April, and nothing is assumed here about it.
The decision was written with the rest of the sector in mind. The Commissioner said every RentTech provider should assess what information it is reasonably necessary to collect at the time of a tenancy application, and the determination records that it would be provided to real estate peak bodies.
Discrimination law and the software that sorts
Queensland's Anti-Discrimination Act 1991 applies to accommodation. The Queensland Human Rights Commission, which handles complaints under the Act, explains that it covers tenancies and, within them, eligibility criteria, references, conditions, rent, bonds and eviction. The attributes the Commission names on its housing pages include age, sex, race, impairment, religion, pregnancy, parental status and sexuality.
Related readAI-written listing descriptions: who answers for the errors?The Commission's examples are written for people, but they translate to software with little effort. It lists charging a higher bond or rent because a tenant has children, inspecting more often because of a tenant's age or because the tenant is Aboriginal, and refusing accommodation to people with disabilities. It also lists asking unnecessary questions on an application form about marital status, number of children, health conditions or religious beliefs. Against those it sets practices it regards as reasonable: asking for proof of identity and of ability to pay the rent, seeking references from all prospective tenants equally, and applying the same terms to everyone.
Responsibility is shared. The Commission says real estate agents must not act on discriminatory instructions from property owners, and that both the agent and the owner can be liable where they do. It adds that an employer or organisation does not avoid liability merely because it was unaware of the conduct. Neither page mentions algorithms. The principle they state is about who answers for a decision, and it does not change with the instrument used to make it.
There are exemptions, and the Commission lists them. The one most relevant to private renting allows an owner who rents rooms in their own home to no more than three people to choose on any attribute. Others cover charities, religious bodies, educational institutions and accommodation set up for the welfare of a particular group.
Why deleting a field does not delete the bias
The intuitive fix for a discriminatory score is to remove the sensitive field: do not feed the software an applicant's sex, age or ethnicity, and it cannot use them. A technical paper published by the Australian Human Rights Commission in 2020 explains why that is not enough.
The paper, "Using artificial intelligence to make decisions: Addressing the problem of algorithmic bias", was produced with Gradient Institute, the Consumer Policy Research Centre, CHOICE and CSIRO's Data61. It defines algorithmic bias as outputs of an AI system that show erroneous or unjustified differential treatment between two groups. It does not use housing as its test case. Its worked simulation is an electricity retailer using AI to decide which prospective customers to offer a competitive contract, run through five scenarios. The reasoning carries over to any system that decides who gets an offer.
A system can rebuild an attribute it was never given
In the Australian Human Rights Commission's simulation, sex was removed from the data. The system then used browsing history as a stand-in and marked down people who visited websites popular with women. Other fields that travel with a protected attribute can do the same work.
The paper sorts the causes of bias into three groups. Some inequality already exists in society and is faithfully reproduced by a system trained on it. Some comes from data that is inaccurate, insufficient, unrepresentative or out of date. Some comes from the design of the system. Within those it describes historical bias, where old records no longer match present conditions; label bias, where the outcome the system learned from was itself recorded unevenly between groups; and under-representation, where too few examples of a group exist for the system to predict well for its members.
On the law, the paper says a business that decides using a biased AI system faces legal, financial and reputational risks. It names federal discrimination statutes, among them the Racial Discrimination Act 1975, the Sex Discrimination Act 1984 and the Age Discrimination Act 2004, and distinguishes direct discrimination from indirect discrimination, where a rule that looks neutral falls more heavily on one group. It lists five ways of reducing bias: obtaining better data, pre-processing the data, making the model more complex, modifying the system and changing the outcome it is trained to predict.
Tenancy databases: the oldest screening tool
Long before scores, agents screened applicants against tenancy databases, privately run records of people who have rented. The RTA describes a tenancy database as a record holding personal information about someone who has lived in a rental property, and Queensland regulates listings closely.
A person may be listed only after the tenancy has ended and only for an approved reason. The RTA gives three. The first is an amount owing that is greater than the rental bond, in set circumstances such as an unpaid tribunal order or conciliation agreement, arrears not remedied after a Notice to remedy breach, or abandonment. Where no bond was paid, the amount must exceed one week's rent. The second and third are objectionable behaviour and repeated breaches, in each case only where the tribunal ended the tenancy for that reason. The RTA adds that a tenant experiencing domestic and family violence should not be listed for breaches caused by the person using violence.
Listings expire. The RTA says all listings must be removed after three years. A tenant can dispute a listing that is inaccurate, incomplete, ambiguous, out of date or outside the approved reasons, within six months of becoming aware of it. Penalties run up to 50 penalty units for an individual for each offence, and higher for a corporation.
Two duties apply at the application stage. A manager who uses databases must tell the applicant which ones are usually used, that the purpose is to check tenancy history, and how to reach the database operator; the RTA gives a maximum of 20 penalty units for failing to do so. And where an applicant is found on a database, the manager must inform the person in writing which database holds the listing, what it is for and how it can be amended or removed.
The contrast with scoring is plain. A database listing has a defined trigger, a defined life and a defined right of challenge. The pages read for this guide set out nothing equivalent for a platform's score.
A tenancy database listing has an approved reason, a three-year life and a right of dispute. A platform's score has none of the three written into the pages that govern it.
Questions an applicant can put to an agency
The rules above give an applicant in Queensland several questions that an agency should be able to answer. They are general, and how they apply depends on the agency and the property.
- What is the second way to apply? The RTA requires at least two methods, one of them not restrictive.
- Does the form ask for anything on the RTA's prohibited list: legal action, breach notices, bond history, credit or bank transaction statements?
- How many supporting documents are being requested in each category? The limit is two.
- Which tenancy databases does the agency usually check? The applicant must be told.
- Is a paid check required? On the RTA's description, a method that makes the applicant pay is a restrictive one.
- When will the application's information be destroyed if it is unsuccessful? The RTA's period is three months from the start of the successful tenant's agreement.
- Is the application ranked or scored by software, and on what? No page read for this guide requires an answer to that one, which is a fair summary of where the law stands.
The three bodies behind these rules work separately. The RTA publishes the tenancy rules and the penalties attached to them. The Queensland Human Rights Commission says a person who believes they have met discrimination in housing can lodge a complaint with it. The April determination shows the Office of the Australian Information Commissioner acting on privacy where an organisation is covered by the Privacy Act. Which of the three fits depends on what went wrong.
Kooky, from Shaka
Kooky edits Queensland Estate and builds Shaka, the payment router he made for Queensland property professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.
