No Equity, No Privacy: How the Rental Housing Market Became a Data Broker's Paradise

For the roughly 44 million renter households in the United States, signing a lease has always meant accepting certain constraints—no repainting without permission, no pets in some buildings, no structural modifications. But an increasingly invasive layer has been quietly added to that arrangement: comprehensive, continuous data collection that begins before a tenant moves in and, in many cases, continues long after they leave.

The rental market has become one of the surveillance economy's most productive hunting grounds, and the people living in it are among the least protected consumers in American digital life.

The Screening Gauntlet

Before a prospective tenant ever receives a key, they are typically required to submit to a background and credit screening process administered not by the landlord directly, but by one of dozens of specialized tenant-screening companies. Firms such as TransUnion SmartMove, RentSpree, and Experian RentBureau aggregate credit histories, eviction records, criminal databases, income-verification services, and in some cases social media signals to produce a score or recommendation that landlords use to approve or deny applications.

The data collected during this process is extensive. Applicants routinely surrender their Social Security number, employment history, previous addresses, and banking information—often through web portals with privacy policies that grant the screening company broad rights to retain, share, and in some cases sell that information to affiliated data brokers. Unlike a mortgage application, which is governed by relatively robust federal disclosure requirements under the Equal Credit Opportunity Act and the Fair Housing Act, rental screening occupies a murkier regulatory space.

The Fair Credit Reporting Act does apply to tenant screening, entitling applicants to dispute inaccurate information and to receive an adverse-action notice if they are denied housing. However, enforcement is inconsistent, and the sheer number of companies operating in this space makes oversight difficult. A 2023 report from the National Consumer Law Center documented widespread errors in tenant-screening reports, including eviction records that belonged to different individuals and criminal records that had been expunged.

Smart Buildings, Dumb Consent

For renters who successfully navigate the application process, a second layer of data collection awaits inside the unit itself. The proliferation of "smart" rental properties—buildings equipped with keypad or app-controlled entry systems, smart thermostats, connected appliances, and package-locker networks—has created a continuous stream of behavioral data that flows not to the tenant, but to the property management company and, frequently, to the technology vendors behind the hardware.

Smart-lock companies, for instance, log every entry and exit event associated with a unit. That data reveals occupancy patterns, sleep schedules, the frequency of overnight guests, and the approximate number of people living in a space. Several major property management platforms have integrated this data into lease-compliance monitoring systems designed to flag tenants who may be subletting without authorization. The same data, however, also represents a detailed behavioral profile that has commercial value well beyond lease enforcement.

Thermostats and energy-management systems present a parallel concern. Devices deployed by landlords in multi-family buildings frequently transmit usage data to cloud platforms managed by the device manufacturer, not the tenant. The privacy policies governing those platforms vary widely, and few tenants are in a position to negotiate them.

In a 2022 letter to the Federal Trade Commission, a coalition of housing-advocacy organizations argued that the data generated by landlord-installed smart devices should be classified as sensitive personal information subject to heightened protections. The FTC has not yet issued formal guidance specifically addressing rental-property technology.

The Algorithmic Landlord

Beyond individual properties, a newer category of risk has emerged from the use of algorithmic rent-pricing software. Platforms such as RealPage's YieldStar aggregate occupancy and pricing data across participating properties to generate recommended rental rates. Antitrust litigation filed in 2023 alleges that this practice effectively coordinates pricing among competing landlords in ways that harm tenants—but the privacy dimension is equally significant.

For the system to function, it requires granular data about individual leases, renewal rates, and tenant payment behavior. That information flows into a centralized platform operated by a third-party company with its own data-retention and sharing policies. Tenants are rarely informed that their lease terms are being fed into such a system, and the legal framework governing this kind of secondary data use remains underdeveloped.

What the Law Does—and Does Not—Protect

Federal privacy law in the United States does not include a comprehensive consumer data-protection statute comparable to the European Union's General Data Protection Regulation. Renters therefore rely on a patchwork of sector-specific rules and state laws that leave substantial gaps.

California's Consumer Privacy Act and its 2020 amendment, the California Privacy Rights Act, give California residents the right to know what personal data companies collect about them, to request deletion, and to opt out of the sale of that data. Washington, Colorado, Virginia, and a handful of other states have enacted similar frameworks. For the majority of American renters, however, no equivalent state-level protection exists.

Some municipalities have moved to fill the gap. New York City's Local Law 144, which took effect in 2023, regulates the use of automated employment-decision tools—a model that housing advocates argue should be extended to tenant screening. Seattle has enacted source-of-income protections that limit certain forms of discriminatory screening. These are meaningful steps, but they are geographically narrow and do not address the full scope of data collection occurring in smart rental properties.

Practical Steps for Renters

Given the current legal landscape, renters who wish to limit their exposure must largely act on their own initiative. Several concrete measures can reduce risk without requiring technical expertise.

Before applying: Request a copy of the screening company's privacy policy and data-retention schedule before submitting an application. Under the FCRA, applicants are entitled to know which consumer reporting agency was used and to obtain a free copy of the report. Review it carefully for errors before signing any lease.

Before moving in: Ask the property manager to identify all connected devices installed in the unit and to provide documentation of the data policies governing each. Request that any smart devices be configured to transmit data only to the landlord rather than to third-party cloud platforms, where lease terms permit this.

Network hygiene: If the building provides Wi-Fi, treat it as an untrusted network. Use a reputable VPN for sensitive communications, and consider maintaining a separate mobile data connection for financial transactions and personal correspondence.

Limit voluntary disclosure: Rental listing platforms and tenant-portal apps frequently request location permissions, contact-list access, and other device data that is not operationally necessary. Review and restrict app permissions on a regular basis.

Exercise data-subject rights: In states with applicable privacy laws, submit data-deletion and data-access requests to tenant-screening companies and property-management software providers. Even where legal obligations are limited, many companies will comply with reasonable requests.

The Structural Imbalance

Ultimately, the privacy vulnerability renters face is not merely a technical problem—it is a structural one. Homeowners control the physical infrastructure of their living space and, by extension, the data it generates. Renters do not. The landlord-tenant relationship creates an inherent asymmetry in which one party has both the legal authority and the commercial incentive to deploy data-collection systems that the other party must accept as a condition of housing.

Until federal legislation establishes baseline protections for data generated in rental housing—covering screening companies, smart-device vendors, and algorithmic management platforms alike—that asymmetry will continue to compound. For now, awareness and deliberate personal practice remain the most reliable defenses available to the millions of Americans who rent their homes and, increasingly, the data that defines their lives within them.