Parents across India must be provided the option to refuse or withdraw consent for sharing their children’s Aadhaar details under the Automated Permanent Academic Account Registry (APAAR) scheme, the Supreme Court has ruled.
In an order issued on July 20, a three-judge bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana directed the Central Board of Secondary Education (CBSE) and all implementing administrative bodies to enforce the safeguard on a pan-India basis. The ruling requires authorities to modify the standardized APAAR consent form so guardians can explicitly withhold or decline consent.
The court also ruled that any personal information collected under the academic scheme must not be disclosed or shared with private entities or third parties unless authorized by law.
High Court Precedent Applied Nationally
The top court’s direction adopts a precedent set in a December 12, 2025 judgment by the Orissa High Court in Rohit Anand Das vs. State of Odisha. Paragraph 19 of that decision instructed state authorities to incorporate clear refusal and opt-out choices into the scheme’s model consent form. The Supreme Court emphasized that such measures are vital to ensure consent remains meaningful and informed.
The ruling addresses petitions filed by parents challenging the constitutional validity of the APAAR system. The petitioners contended that the initiative functions as a state surveillance mechanism within the education sector by enabling long-term tracking, profiling, and monitoring of children. They raised privacy and data protection concerns regarding the extensive retention of information and its potential misuse beyond educational purposes.
Data Protection Obligations Mandated
The bench dismissed fears regarding the misuse of data from voluntary enrollees, calling those concerns misconceived. The justices clarified that executing data collection under an administrative scheme rather than a statutory mandate does not exempt government authorities from their data protection duties.
The court ordered that all collection, retention, processing, and sharing of personal data under the APAAR scheme must strictly adhere to the Digital Personal Data Protection Act, 2023. Under the statute, designated data fiduciaries are legally required to handle student data in a secure, lawful, and purpose-limited manner.
