Aadhaar for Tatkal Tickets: Kerala High Court Upholds Authentication

Why in News?

The Kerala High Court on 22 July 2026 dismissed a public-interest challenge to Aadhaar-based authentication for online Tatkal bookings in Bahadur Shah Anakkot Nasirali v. Union of India, WP(PIL) No. 129 of 2025. The Hindu reported that the Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar V.M. found no privacy violation in this channel-specific arrangement.

The ruling is narrow. It upheld the Railway policy because the authentication serves an anti-abuse purpose and passengers may still buy offline Tatkal tickets without Aadhaar authentication. The Court only said IRCTC may consider PAN authentication as another option; it did not direct PAN adoption or approve compulsory Aadhaar for unrelated services.

• The challenged measure was Railway Board Commercial Circular No. 08 of 2025, dated 10 June 2025.
• From 1 July 2025, online Tatkal tickets through the IRCTC website or app became available only to Aadhaar-authenticated users.
• From 15 July 2025, Aadhaar-based OTP authentication also became compulsory for an online Tatkal booking.
• At computerised PRS counters and through authorised agents, the rule uses a system-generated OTP sent to the mobile number furnished at booking, not Aadhaar authentication.
• The Court treated prevention of touting, bulk booking and automated misuse as a legitimate justification linked to fair access.

The development matters in the context of:

• The case places digital identity within the constitutional framework of privacy, choice and proportional state action.
• It shows why the design of an alternative service channel can determine whether an identity requirement is voluntary in practice.
• It raises whether anti-bot controls can meet the same objective with less identity linkage.

UPSC Relevance

Prelims Relevance

• Article 21 protects life and personal liberty; the Supreme Court recognised privacy as an intrinsic fundamental right in the 2017 nine-judge Puttaswamy decision.
• Aadhaar authentication verifies submitted identity information against the Central Identities Data Repository and returns a response from UIDAI.
• An OTP-based authentication uses a limited-validity OTP sent to the mobile number or email registered with UIDAI.
• Under Section 4(3) of the Aadhaar Act, voluntary Aadhaar use for authentication rests on the informed consent of the number holder.
• Under Section 4(4), an entity may perform authentication only if statutory privacy and security conditions and the prescribed legal route are satisfied.
• Section 8 requires consent, purpose-linked use of identity information and prior information about the authentication response, its use and available alternatives.
• An Aadhaar number or its authentication is not, by itself, proof of citizenship or domicile.
• PRS counter OTP and Aadhaar-based OTP are not identical: the former goes to the mobile number furnished at booking, while the latter is tied to the Aadhaar authentication process.
• The Court’s observation on PAN is recommendatory: IRCTC may consider it as an alternative authentication route.

Mains Relevance

GS Paper 2

• Applying the right to privacy, informed consent and proportionality to identity checks on a mass public-service platform.
• Examining whether an offline counter is a meaningful and viable alternative when the faster digital channel requires Aadhaar.
• Balancing administrative discretion, judicial review and the need for reasoned digital-governance safeguards.

GS Paper 3

• Using digital public infrastructure, OTP authentication and anti-bot controls to protect a high-demand ticketing system.
• Managing cybersecurity, account uniqueness and data minimisation without creating exclusion or a single point of identity failure.

Essay

• In a digital state, convenience cannot replace consent, and consent cannot be meaningful without a practical alternative.
• Fair access to scarce public resources requires both technological controls and constitutional restraint.

Background and Context

What the Kerala High Court Actually Held

The judgment upheld one Railway booking arrangement on its stated facts, not an unrestricted power to demand Aadhaar.

• The Bench accepted the policy’s link to past experience of deceit, manipulation and bulk booking on the Tatkal platform.
• It found the decision not unjustified under the proportionality test, chiefly because Aadhaar use was confined to the online Tatkal route and a counter route remained.
• The judgment expressly clarified that offline Tatkal purchase does not require Aadhaar-based authentication.
• Only the IRCTC user needs Aadhaar authentication; the passengers named on the online ticket don’t each need it.
• The respondents called profile authentication a one-time exercise. The circular separately requires Aadhaar-based OTP for online Tatkal bookings from 15 July 2025.
• The Court found substance in the suggestion that PAN authentication could serve a similar purpose, but used the permissive words “may consider” rather than issuing a binding command.
• Any future Aadhaar mandate still needs its own legal basis, safeguards and alternatives.

Railway Board's Tatkal Authentication Rules

Commercial Circular No. 08 of 2025 created different identity controls for online users, counters and authorised agents.

• Online access changed first: from 1 July 2025, only Aadhaar-authenticated IRCTC users could book Tatkal tickets through the official website or app.
• A second online layer began on 15 July 2025: Aadhaar-based OTP authentication became compulsory for a Tatkal booking.
• For a PRS counter or authorised agent, a system OTP is sent to the mobile number supplied at the time of booking. The circular doesn’t require Aadhaar authentication for this route.
• Authorised agents cannot book opening-day Tatkal tickets in the first 30 minutes: 10:00-10:30 a.m. for AC classes and 11:00-11:30 a.m. for non-AC classes.
• The Court viewed the counter as the route for a person who doesn’t have Aadhaar or declines its use.
• For deeper context, read Anantam IAS’s explainer on Digital Public Infrastructure and India Stack.

Aadhaar Act: Voluntary Use and Authorised Authentication

Aadhaar use outside subsidy delivery still has to fit the amended Act and the authentication regulations.

• Section 4(3) allows an Aadhaar number holder to voluntarily use Aadhaar to establish identity through authentication or offline verification; informed consent is central to voluntary use.
• Section 4(4) permits an entity to perform authentication when UIDAI is satisfied about prescribed privacy and security standards and the entity follows an authorised legal route.
• The Gazette notification referred to in the litigation allowed CRIS to perform Aadhaar authentication on a voluntary basis for specified railway identity purposes.
• Section 8 requires consent, explanation of data use and alternatives, and purpose-linked authentication.
• Aadhaar identifies a number holder; under Section 9, it doesn’t by itself establish citizenship or domicile.
• The legal framework should be read with the site’s Right to Privacy in India notes.

Authentication, Consent and Data Minimisation

The privacy impact depends on what data moves, who retains it and whether the user’s choice is real.

• UIDAI defines authentication as checking submitted Aadhaar-linked identity information against the Central Identities Data Repository.
• The respondents stated that authentication uses encrypted channels and IRCTC or Railways doesn’t store Aadhaar numbers.
• They said the requesting entity cannot access the Aadhaar database; it gets a yes/no response or permitted e-KYC information.
• These claims reflect data minimisation: collect or receive only what is necessary for the declared purpose, and retain it only as long as lawfully needed.
• Informed consent needs a clear purpose, understandable notice, limited use and a lawful alternative pathway.
• Controls should include masked identifiers, role-based access, logs, breach response and independent security audits.
• The wider setting appears in Anantam IAS’s DPDP Act 2023 explainer.

Privacy and the Proportionality Test

Privacy is not absolute, but an interference needs a lawful, legitimate and carefully tailored justification.

• The 2017 Puttaswamy privacy judgment located privacy within liberty, dignity and autonomy protected by Part III, especially Article 21.
• A proportionality inquiry asks whether the measure has a legal basis, pursues a legitimate aim, is rationally connected to that aim and does not burden the right more than needed.
• Here, the legitimate aim was fair access to scarce Tatkal seats by curbing touts, syndicates, multiple accounts and automated requests.
• The rational-connection claim was that verified user uniqueness reduces artificial demand before requests reach the seat-allocation system.
• The Court’s least-restrictive reasoning relied heavily on offline access without Aadhaar and left room for IRCTC to assess PAN authentication.
• A critical reading can still ask whether travel to a counter, queueing and limited counter access make the alternative equally viable for every user.

Anti-Bot Rationale and Public-Service Fairness

Railways presented Aadhaar as one demand-control layer within a broader cybersecurity and anti-fraud system.

• IRCTC said authentication supports one-person, one-booking logic and filters high-frequency access before seat allocation.
• A February 2026 Railway Ministry reply said 3.03 crore suspicious user IDs were deactivated during 2025.
• The same official reply reported 60.43 billion malicious bot requests blocked across July-December 2025, alongside CAPTCHA, anti-bot, firewall and DDoS controls.
• Identity checks should complement capacity scaling, secure coding and bot mitigation, while accessible alternatives protect excluded users.

Way Forward

Offer equivalent authentication choices

• Evaluate PAN or another secure ID route for uniqueness, real-time verification and fraud resistance.
• Where technology permits, users who don’t choose Aadhaar should receive an online alternative, not only a physical counter fallback.

Make consent and minimisation auditable

• Explain purpose, response type, retention and grievance channel before authentication.
• Publish retention schedules and independent audit summaries confirming that Aadhaar numbers and core biometrics aren’t stored by the ticketing entities.

Measure effectiveness and exclusion

• Publish bot, authentication-failure and counter-use metrics to test necessity and proportionality.
• Track exclusion complaints by region and user group, with a fast human-assisted redress mechanism during short Tatkal windows.

Use layered cybersecurity

• Combine identity checks with rate limits, CAPTCHA, account-age controls and anti-bot systems.
• Periodically reassess whether a less identity-intensive control can meet the objective with a smaller privacy burden.

Conclusion

The Kerala High Court accepted Aadhaar authentication for online Tatkal booking because the policy targets documented abuse, uses a regulated authentication framework and leaves the counter channel open without Aadhaar. That combination, not Aadhaar alone, shaped the Court’s proportionality finding.

The durable lesson is narrower and more useful: every digital identity requirement must remain purpose-bound, minimal, secure and reviewable. A workable alternative, transparent evidence and continuous oversight are what keep anti-fraud governance compatible with constitutional privacy.

UPSC Practice Questions

Prelims MCQ 1

With reference to the Railway Board’s 2025 Tatkal booking rules, consider the following statements:

1. From 1 July 2025, online Tatkal booking through the IRCTC website or app is available only to Aadhaar-authenticated users.
2. At computerised PRS counters, the OTP is sent to the mobile number furnished by the user at booking and Aadhaar authentication is not required.
3. Authorised agents may book opening-day Tatkal tickets from the first minute of the booking window.

How many of the above statements are correct?

(a) Only one (b) Only two (c) All three (d) None

Answer: (b) Only two

Explanation:

Statements 1 and 2 are correct. Authorised agents are barred during the first 30 minutes: 10:00-10:30 a.m. for AC classes and 11:00-11:30 a.m. for non-AC classes.

Prelims MCQ 2

Which one of the following best describes the Kerala High Court’s ruling on Aadhaar authentication for Tatkal tickets?

(a) It made Aadhaar compulsory for every railway ticket and every passenger (b) It struck down all identity checks for online Tatkal booking (c) It upheld the online Tatkal arrangement, clarified that offline Tatkal needs no Aadhaar authentication, and asked IRCTC to consider PAN (d) It ordered IRCTC to replace Aadhaar with PAN immediately

Answer: (c) It upheld the online Tatkal arrangement, clarified that offline Tatkal needs no Aadhaar authentication, and asked IRCTC to consider PAN

Explanation:

The holding is channel-specific. The Court treated the counter route as an alternative and made only a recommendatory observation on PAN; it issued no universal Aadhaar mandate.

UPSC Mains Questions

1. The Kerala High Court’s Tatkal ruling turns on both a legitimate anti-fraud objective and the availability of an offline alternative. Examine how legality, necessity, rational connection and balancing should guide judicial review of identity authentication on public digital platforms. (15 marks, 250 words)
2. A choice between Aadhaar-enabled online access and a physical counter may be legally available without being equally accessible. Critically discuss meaningful consent, digital exclusion and the State’s duty to provide viable alternatives in technology-mediated public services. (15 marks, 250 words)
3. Data minimisation is an architectural principle, not merely a privacy notice. Using Aadhaar authentication for Tatkal tickets as context, suggest institutional and technical safeguards that can curb automated abuse while limiting identity collection, retention and function creep. (10 marks, 150 words)

Sources: Ministry of Railways, Railway Board and The Hindu.

Frequently Asked Questions