Adv. Mohona Chowdhury* & Rajan Chaudhary**
Introduction
Every child in an Indian school is now being offered a number meant to follow them for life. The Automated Permanent Academic Account Registry (APAAR), introduced under the National Education Policy, 2020 as “One Nation, One Student ID”, gives each student a 12-digit identifier that is authenticated through Aadhaar and linked to DigiLocker and the Academic Bank of Credits. By July 2026, more than 26 crore such IDs had been verified. The promise is portability. Marksheets, transfer certificates and credits are supposed to travel with the student instead of waiting in a school cupboard.
The legal underpinning is more tenuous than the promise. No proper legislation underpins APAAR. It rests entirely on executive circulars, and one safeguard the government constantly cites is parental consent. This piece argues that the parental consent won through litigation in 2025 and 2026 is not as strong as it might seem. The law under which the Supreme Court now placed APAAR, the Digital Personal Data Protection Act, 2023 (DPDP Act), provides the State with means to bypass consent once its provisions on child data kick in from May 2027. Additionally, the Act doesn’t mention what happens to the parent’s consent when the child reaches 18. These two lapses should be addressed before the scheme is saturated.
How Parents Won the Right to Say No
The circular that was published by the Ministry of Education on 11 October 2023 put forth that parental consent must be made a prerequisite, yet the model form, as the petitioners in the recent case of Abhishek Baxi v. Union of Indialater told the Supreme Court, offered no way to decline. Practice made matters worse. In August 2025, CBSE made an APAAR ID a precondition for registering Class IX to XII students for board examinations, and relaxed the rule only partly by letting schools mark entries as “REFUSED” or “NOGEN”. Authorities in Uttar Pradesh sought derecognition of 90 madrasas for non-compliance, and the Internet Freedom Foundation documented schools calling meetings to push enrolment. A scheme described as voluntary was running on targets.
In Rohit Anand Das v. State of Odisha, decided on 12 December 2025, the Orissa High Court held that a form offering a single option could not be reconciled with a voluntary scheme or with the right to privacy, and directed the authorities to consider adding an opt-out. In July 2026, a bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana, in the case of Abhishek Baxi v. Union of India, issued that direction nationwide, calling the opt-out essential to make consent “meaningful and informed”. The Court added two directions for the parties. All processing under APAAR would be carried out in accordance with the DPDP Act, and data would not be shared with private entities or third parties except under the provisions of law. Earlier, in April 2026, NCERT had clarified that no child could be refused admission for want of an APAAR ID.
These rulings stand on familiar ground. Justice K.S. Puttaswamy v. Union of India (2017) requires any State intrusion into privacy to satisfy legality, a legitimate aim and proportionality. The Aadhaar judgment of 2018 applied that test to children, and found that school admission cannot be made conditional on Aadhaar, and also that a child enrolled through parental consent has to be allowed to withdraw upon attaining majority. However, neither court tested APAAR against the first limb, legality. There’s still no law. Consent has been asked to bear the burden that the law should bear; hence, its fragility is important.
The Statute that Could Make Consent Optional
Section 9(1) of the DPDP Act requires a Data Fiduciary to obtain verifiable parental consent before processing a child’s data, and Rule 10 of the Digital Personal Data Protection Rules, 2025 prescribes how that consent is verified. Section 9(3) prohibits tracking and behavioural monitoring of children altogether. On paper, this is a strong regime. In practice, Rule 12 and the Fourth Schedule switch off both provisions for listed classes and purposes, and two entries fit APAAR almost exactly.
Item 2 of Part B exempts processing for providing any “subsidy, benefit, service, certificate, licence or permit … under law or policy or using public funds, in the interests of a child” under section 7(b) of the Act. APAAR is a service created by policy, funded with public funds, and justified as being in the child’s best interest. Section 7(b), in turn, allows the State to process personal data without consent when providing a benefit or service, where the data is already held in a government database notified for that purpose. UDISE+, which already holds records of nearly every school student, is the obvious candidate. Read together, these provisions would allow the Ministry to treat APAAR as a “legitimate use” from May 2027, needing neither consent nor verification, and freed from the bar on tracking. The opt-out box that two courts fought to add would then sit on a form that the law no longer requires.
Item 3 of Part A offers a second route. It permits an educational institution to carry out tracking and behavioural monitoring “for the educational activities of such institution”. A lifelong academic record is, in functional terms, longitudinal tracking. The better reading is that the words “such institution” tie the exemption to a school’s own teaching and safety needs, and cannot stretch to a national registry that outlives the student’s time at any one school. That reading, however, is an argument and not a settled rule, and the Data Protection Board has said nothing on it so far.
The Abhishek Baxi order does not close these doors. It states that processing shall be carried out in accordance with the DPDP Act, and if processing is allowed by the DPDP Act without the consent of the person, it is possible that the order could lend legitimacy to the processing. The Court did not rule that consent must continue to be a legal basis, but rather that it must be meaningful. The threat is real and not hypothetical. MeitY has revealed that more than two crore children were identified using a technical integration with UDISE+ for compulsory biometric updates at camps organised in approximately 1.56 lakh schools without a consent form for these camps being published. The database, which was created for counting students, is already used in ways it was never intended. One protection, however, remains. Only sub-sections (1) and (3) of section 9 are disapplied under Rule 12, so section 9(2), which prohibits any processing likely to bring about a detrimental effect on the child’s well-being, remains binding for every Data Fiduciary, including the State.
Consent That Expires, A Record That Does Not
The revised consent form describes APAAR as a “lifelong digital academic record”. A parent signs it for a child who may be six. Under section 2(f) of the DPDP Act, a person ceases to be a child at eighteen, and the parent’s authority to consent ends with it. The Act, however, provides no moment at which the young adult is asked whether she agrees with what was done in her name. Her data continues to be processed on a consent she never gave.
The Act’s other safeguards do not fill this gap. Section 6(4) allows consent to be withdrawn with ease “comparable to the ease with which such consent was given”, but withdrawal assumes that the adult knows the record exists and remembers that she can object. Section 8(7) requires erasure once the specified purpose is no longer served, yet a purpose defined as lifelong is designed never to lapse. The retention periods in the Third Schedule to the Rules are aimed at large commercial platforms, not State registries. The form also records a refusal in UDISE+, so a parent’s decision to say no becomes a lasting entry against the child in a government database.
Indian law has answered this problem once before. In the Aadhaar judgment, the Supreme Court accepted that a parent’s consent cannot bind the adult the child becomes, and gave children an exit on reaching majority. European law arrives at the same point through Recital 65 of the General Data Protection Regulation, which gives special weight to erasure where consent was given as a child without full awareness of the risks. APAAR’s design ignores both.
Fixing The Architecture Before May 2027
First, APAAR needs a proper legal basis. APAAR should be based on a statute, if possible, or at least on notified rules, which specify the data fields to be collected, the purpose of the processing, the entities who may access the record, and the time for which they are retained. Without this, no consent form can satisfy the first limb of Puttaswamy.
Second, the Union should agree in a notified instrument, rather than a press release, that APAAR will remain a consent-based scheme and will not be moved to section 7(b) or Item 2 of Part B. The better alternative would be to revise the Fourth Schedule in such a way that Item 2 does not extend to identity registries of a permanent nature; and for the Data Protection Board to make it clear that Item 3 of Part A of the Schedule can only be relied upon by the institution itself and cannot serve as a basis for a national register.
Third, the law should call for re-consent on attaining majority. A student should be notified via DigiLocker when she reaches age 18 and asked if the record can continue. If she doesn’t, then the record should be reduced to the certificates that she earned, and everything else should be archived or deleted. This brings the Aadhaar exit principle to the one scheme where it is most required.
Fourth, refusal and withdrawal should be simple and neutral. A refusal should be recorded only as a non-generation flag that can be seen by the school, and not as a note in a national database, and withdrawal should be as easy as giving consent, in the same manner, so that section 6(4) is respected in practice. Lastly, the clause in the new consent form for dissemination of academic information to “Talent/Skill Identification Agencies (Recruitment)” needs to be removed. It doesn’t sit well with the Court’s prohibition on disclosure to private parties or with section 9(2).
Conclusion
APAAR is a level-headed notion undertaken in reverse order. First, the database, then, after a lot of nudging, consent, then, finally, the law. The courts have given parents the right to refuse, but that right is a form, and the DPDP regime has enough exemptions to make it irrelevant. For voluntariness to be meaningful, it must be enshrined in law by May 2027 and be transferred to the child at age 18. A child may have a number for her lifetime. No one can give consent for a lifespan. This loophole needs to be addressed effectively by lawmakers to prevent any disputes that may arise in the future.
* The author is a practicing advocate and a first-year LL.M. student at the Department of Law, University of Calcutta. The author may be contacted at advmohonachowdhury@gmail.com.
** The author is an LL.M. student at National Law University, Jodhpur. He may be contacted at rajan.chaudhary26@nlujodhpur.ac.in.
This blog reflects the personal views of the authors and does not necessarily represent the views of The Policy Chronicle.