APAAR and Children’s Aadhaar Data: Supreme Court Mandates Informed Opt-Out

Why in News?

In Abhishek Baxi & Others v. Union of India, the Supreme Court on 20 July directed authorities implementing the Automated Permanent Academic Account Registry, or APAAR, to give nationwide effect to an Orissa High Court direction on an express parental opt-out. The record of proceedings became publicly available on 25 July.

The Court also clarified that every stage of processing personal information under APAAR must comply with the Digital Personal Data Protection Act, 2023. Data cannot be shared with a private entity or third party except according to law and strictly for an authorised purpose.

• The case was Writ Petition (Civil) No. 832 of 2026, filed under Article 32 by parents of students in CBSE-affiliated schools.
• The three-judge Bench comprised the Chief Justice of India, Justice Joymalya Bagchi and Justice V. Mohana.
• The Court adopted the approach in Rohit Anand Das v. State of Odisha, where the High Court had asked authorities to consider amending the model consent form to include an opt-out or refusal option.
• The nationwide direction seeks to make parental consent meaningful and informed rather than a formality with only an affirmative choice.
• The petition was disposed of with safeguards, while the respondents, who had not been heard at that stage, were given liberty to seek clarification.

The development matters in the context of:

• The ruling matters in the context of informational privacy: a child’s identity and academic history can remain linked across institutions and stages of education.
• It also tests whether a formally voluntary digital service remains voluntary when schools or examination processes create practical pressure to enrol.
• The issue connects education governance with data minimisation, purpose limitation, security, retention and effective grievance redress.

UPSC Relevance

Prelims Relevance

• APAAR stands for Automated Permanent Academic Account Registry and is presented by the Ministry of Education as a lifelong academic identity.
• The official APAAR portal describes the ID as a 12-digit code linked to academic records and credentials.
• APAAR works with the Academic Bank of Credits, DigiLocker and UDISE+ to support record access, transfer and credit mobility.
• For a minor, the official process includes parental consent, demographic verification and identity authentication through the school.
• A Permanent Education Number, or PEN, in UDISE+ is a stated prerequisite for generating an APAAR ID.
• Under the DPDP Act, a child means a person who has not completed 18 years of age.
• Section 9 of the DPDP Act requires verifiable parental consent before processing a child’s personal data, subject to notified exceptions.
• The right to privacy is protected as part of life and personal liberty under Article 21, following the Puttaswamy ruling.
• The Supreme Court’s present order extended the opt-out direction pan-India; it did not abolish APAAR or hold the scheme unconstitutional.

Mains Relevance

GS Paper 2

• Fundamental rights: informed consent, informational privacy and the proportionality of State-backed digital identity systems.
• Governance: accountability of schools, CBSE and implementing authorities when an administrative scheme handles children’s sensitive educational records.
• Social justice: the risk that a digital prerequisite may exclude children from admission, examinations or services even when enrolment is described as voluntary.

GS Paper 4

• Public-service ethics: consent loses moral value when refusal carries hidden educational penalties.
• Trust and stewardship: authorities collecting children’s data carry a heightened duty of care, transparency and restraint.

Essay

• Digital public infrastructure earns legitimacy through meaningful choice, limited purposes and enforceable accountability.
• A child’s data may be useful for service continuity, but administrative convenience cannot replace autonomy and constitutional safeguards.

Background and Context

What APAAR Is Designed to Do

APAAR is meant to create continuity in a student’s verified academic identity and records.

• The Supreme Court described APAAR as an Aadhaar-linked lifelong digital academic identifier associated with the objectives of the National Education Policy, 2020.
• Its stated purposes include seamless academic records, transfers across institutions and States, and academic credit mobility through the Academic Bank of Credits.
• The official portal says the ID can consolidate scorecards, marksheets, grades, degrees, diplomas, certificates and co-curricular achievements.
• The creation flow links a student’s UDISE+ record and PEN with verified demographic information; the completed APAAR ID is placed in DigiLocker.
• For a fuller account of its architecture, see APAAR ID and its academic-record ecosystem.

What the Parents Challenged

The petition questioned whether consent was real when schools and examination processes allegedly made refusal costly.

• The parents challenged the constitutional validity of the scheme and the requirement to furnish children’s Aadhaar details as a precondition for registration.
• They alleged that the system could enable long-term tracking, profiling and monitoring of educational trajectories. These were petitioners’ contentions, not factual findings recorded by the Court.
• They argued that the model consent form did not clearly state the purpose, scope, retention period or data-sharing practices, and did not offer an express refusal choice.
• The order records an allegation that some schools threatened denial of admission, Board-examination registration or other services. It also records alleged pressure tied to APAAR enrolment targets.
• The petitioners relied on the privacy test of legality, legitimate aim, necessity and proportionality developed in the Puttaswamy framework.

The Nationwide Opt-Out Direction

The Court treated an express refusal route as an essential safeguard for meaningful and informed consent.

• In Rohit Anand Das, the Orissa High Court had directed authorities to consider amending the model consent form to include an opt-out or refusal option and to pass necessary orders.
• The Supreme Court directed all concerned authorities implementing APAAR to give paragraph 19 of that High Court judgment effect across India.
• The precise formulation matters: the Supreme Court extended the High Court’s direction nationwide; it did not itself publish a rewritten form or prescribe its exact wording.
• An opt-out must be visible, intelligible and usable. A form offering only “I consent” cannot establish that refusal was freely available.
• An operational safeguard should also prevent schools from attaching an unauthorised penalty to refusal, because coerced participation would defeat the basis of consent.

DPDP Act Duties for Children's Data

The Court placed the full lifecycle of APAAR personal data within the DPDP Act, not merely the initial collection step.

• The order covers collection, processing, storage, retention, sharing and use. Compliance cannot be reduced to obtaining a signature once.
• Section 6 says consent must be free, specific, informed, unconditional and unambiguous, expressed through a clear affirmative action and limited to data necessary for the specified purpose.
• Section 5 requires notice about the personal data sought, the purpose of processing, the exercise of rights and the route for a complaint.
• Section 9 requires verifiable parental consent before processing a child’s data and prohibits processing likely to harm a child’s well-being, subject to the Act’s notified framework.
• A data fiduciary must take reasonable security safeguards, respond to breaches as required and erase data when the purpose ends or consent is withdrawn unless lawful retention is necessary.
• The durable statutory framework is explained in DPDP Act 2023: consent and data-fiduciary duties.

Purpose Limitation and Third-Party Sharing

The Court rejected the idea that an administrative scheme sits outside data-protection law.

• The Bench said the non-statutory origin of a scheme does not release authorities from their obligations to protect personal data.
• Processing must be lawful, secure and purpose-limited. Academic record continuity cannot become a blanket justification for unrelated profiling or secondary use.
• Personal information cannot be disclosed to a private entity or third party except in accordance with law and strictly for an authorised purpose.
• This is not an absolute ban on every processor or integration. It is a legal-purpose test that should cover role definition, access controls, contracts, audit trails and data minimisation.
• The APAAR privacy policy refers to integration with educational institutions, DigiLocker, the Academic Bank of Credits and cloud providers. Each flow needs a clear legal basis and limited access.

Constitutional Privacy and Children's Autonomy

A child’s education record engages both informational privacy and the conditions for equal access to schooling.

• The right to privacy under Article 21 includes an individual’s interest in controlling personal information, subject to lawful and proportionate restrictions.
• Children require stronger protection because they may not understand persistent identifiers, future data linkage or the consequences of a digital trail created early in life.
• Parental consent is a protective mechanism, but it must be supported by plain-language notice, age-appropriate information and a genuine route to withdrawal or refusal.
• The larger privacy doctrine, including Puttaswamy and Aadhaar, is covered in Right to Privacy in India.
• Digital education can improve portability and reduce paperwork, but its benefits depend on inclusion, interoperability, security and offline alternatives; see Digital Education in India.

Consent as an Administrative Process

The judgment turns consent design from a one-page formality into a continuing governance responsibility.

• A valid choice begins before enrolment: parents need a clear notice identifying the authority seeking data, the exact fields requested, the purpose served and the consequence of refusal. Vague references to educational benefit cannot substitute for a specified purpose.
• The request should separate Aadhaar authentication, creation of the academic identifier, storage of credentials and any later data sharing. Bundling distinct purposes into one signature makes it difficult to know what a parent actually accepted.
• Consent must remain provable. Authorities need a reliable record of the notice shown, the language selected, the decision made and any later withdrawal, while ensuring that the consent log does not become another excessive personal-data repository.
• The school is the practical interface between the family and the digital system. Training, standard scripts and supervisory checks are needed so a teacher or administrator does not convert a voluntary process into de facto compulsion through deadlines or threats.
• A refusal route also needs administrative continuity. The student should still have a documented method to register for examinations, transfer schools and prove academic history through a non-APAAR alternative wherever no law makes APAAR indispensable.
• Withdrawal raises separate questions from refusal at the start. Implementing rules should explain which processing stops, what data is erased, what must be retained under another law and how linked systems receive the withdrawal instruction.
• Accountability requires evidence rather than assurance. Periodic audits should test notices, permissions, retention, processor access, grievances and school-level coercion, with corrective directions tied to a named responsible authority.

What the Order Did Not Decide

The six-page record of proceedings supplied safeguards without resolving every contested question about APAAR.

• The Court did not strike down the scheme, cancel existing IDs or declare every use of Aadhaar in education invalid.
• It did not find that unlawful surveillance or data misuse had already occurred. The Court called concerns about possible misuse misconceived because DPDP obligations continue to bind authorities.
• It did not authorise broad third-party sharing; the permission is confined to what the law and the authorised purpose allow.
• The respondents had not been heard at that stage and were expressly given liberty to seek clarification, a procedural qualification students should note.
• Implementation questions remain: the revised form, consequences of refusal, deletion or retention after withdrawal, grievance channels, auditability and treatment of legacy records.

Way Forward

Redesign consent around a real choice

• Issue a uniform model form with separate, equally visible options to consent or refuse, without pre-ticked boxes.
• State the data fields, each purpose, recipient category, retention period and withdrawal route in plain language and relevant Indian languages.
• Record refusal without repeatedly pressuring parents or treating non-enrolment as an administrative defect.

Separate education access from voluntary enrolment

• Publish binding instructions that refusal cannot by itself block admission, examination registration or access to an educational service unless a specific law requires the identifier.
• Create a workable alternative process for identity verification and academic-record transfer where a student has no APAAR ID.
• Audit school communications and target-setting practices to detect coercion hidden behind formally voluntary language.

Map and minimise every data flow

• Prepare a public data-flow map covering UDISE+, Aadhaar authentication, APAAR, DigiLocker, the Academic Bank of Credits and processors.
• Collect only fields necessary for a declared purpose and enforce purpose-specific access through role-based controls.
• Set documented retention and deletion schedules, including a process for consent withdrawal, account closure and duplicate-record correction.

Build child-centred accountability

• Provide parents and age-appropriate students with accessible routes to inspect, correct and seek erasure of personal data where the law permits.
• Name responsible officers, publish grievance timelines and maintain tamper-evident logs for access and sharing.
• Conduct periodic security and privacy assessments focused on re-identification, unauthorised linkage and harm to children’s well-being.

Report compliance, not enrolment alone

• Measure the rate of informed refusal, correction, grievance disposal and deletion alongside APAAR coverage.
• Publish anonymised compliance reports without exposing school-level or child-level personal information.
• Use independent review to test whether the revised form and school practice meet the Court’s standard of meaningful consent.

Conclusion

The Supreme Court’s order does not reject digital academic infrastructure. It draws a constitutional line around it: APAAR can support portability and continuity, but participation cannot rest on a consent form that hides refusal or on pressure that makes refusal impractical.

The lasting test is implementation. A nationwide opt-out, DPDP-compliant processing, limited sharing and a penalty-free alternative must work at the school counter, not only in policy text. That is how digital education can gain trust without making a child’s data the price of access.

UPSC Practice Questions

Prelims MCQ 1

With reference to APAAR, consider the following statements:

1. It is designed as a lifelong digital academic identifier linked with the Academic Bank of Credits.
2. For a minor, the official creation process includes parental consent.
3. The Supreme Court has declared the APAAR Scheme unconstitutional and ordered all existing IDs deleted.

How many of the above statements are correct?

(a) Only one (b) Only two (c) All three (d) None

Answer: (b) Only two

Explanation:

Statements 1 and 2 are correct. APAAR supports a lifelong academic record and credit mobility, and the official process includes parental consent for minors. Statement 3 is incorrect: the Supreme Court issued opt-out and data-protection safeguards but did not invalidate the scheme.

Prelims MCQ 2

Which one of the following best describes the Supreme Court’s July 2026 APAAR direction?

(a) Aadhaar was prohibited for every educational purpose (b) APAAR enrolment was made compulsory for all school students (c) The Orissa High Court’s opt-out direction was given nationwide effect, with DPDP safeguards (d) Private entities received unrestricted access to APAAR data

Answer: (c) The Orissa High Court's opt-out direction was given nationwide effect, with DPDP safeguards

Explanation:

The Court required concerned authorities to give the opt-out or refusal safeguard pan-India effect. It also required lawful, secure and purpose-limited processing under the DPDP Act and restricted extraneous third-party sharing.

UPSC Mains Questions

1. The Supreme Court’s APAAR order shows that consent in digital governance must be meaningful in both form and practice. Examine how opt-out design, purpose limitation and a penalty-free alternative can reconcile educational record portability with children’s privacy and equal access.
2. Administrative schemes handling children’s data cannot treat statutory privacy duties as optional. Discuss with reference to the APAAR ecosystem, the Digital Personal Data Protection Act, 2023, data-fiduciary obligations, and the accountability of schools and public authorities at each stage of processing.

Sources: Supreme Court of India and The Indian Express.

Frequently Asked Questions