The Supreme Court has stepped into the growing debate around student data privacy, directing Opt-Out Option in APAAR Consent Forms to the Union Government and the Central Board of Secondary Education to build a genuine opt-out mechanism into the consent form for the Automated Permanent Academic Account Registry, commonly known as APAAR.
The ruling arrives at the intersection of privacy law, education policy, and children's rights, making it a timely addition to any CLAT PG preparation on the right to privacy and the Digital Personal Data Protection Act, 2023.
Background: What Is APAAR and Why Was It Challenged
APAAR functions as an Aadhaar-linked lifelong digital academic identifier issued to every student, an initiative rolled out by the Ministry of Education.
Parents of four students filed a writ petition under
Article 32, challenging the scheme's constitutional validity on the ground that it effectively compelled children into Aadhaar enrolment
despite the absence of any statutory mandate requiring it.The petitioners' central grievance was procedural rather than merely substantive. A Ministry of Education circular dated October 11, 2023 made parental consent mandatory, yet the prescribed consent forms neither provided an option to refuse participation nor clearly explained the purpose, scope, or retention period of the data being collected.
Two subsequent CBSE circulars compounded the problem: CBSE, through circulars dated August 5, 2025, and August 27, 2025, made APAAR ID registration a mandatory precondition for registering students of Classes IX to XII for Board examinations from the 2026 academic year onwards.
This combination, the petitioners argued, converted a scheme presented as voluntary into one that was mandatory in substance. Senior Advocate Indira Jaising, appearing for the petitioners, contended that since the APAAR ID is linked to Aadhaar, the compulsion to obtain it essentially means a compulsion to enrol in the Aadhaar program, which, as per the Supreme Court's 2018 judgment, cannot be imposed on children.
The petitioners further submitted that the measures fail to satisfy the
tests of legality, legitimate aim, necessity and proportionality governing State action and therefore
infringe the fundamental right to privacy as held in the Justice K.S. Puttaswamy judgment.The Court's Findings and Directions
A three-judge bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana heard the matter and declined to stay or strike down the APAAR scheme itself. Instead of invalidating the initiative, the Court chose the narrower route of fixing its consent architecture.
The Bench directed that the prescribed consent form must expressly provide parents or guardians with the option to withhold consent, holding that such a safeguard is essential to ensure that consent is "meaningful and informed."
Since that High Court ruling had gone unchallenged, the Supreme Court simply extended its reach nationwide rather than crafting fresh directions from scratch, a pragmatic move that avoided reinventing an already-settled remedy.
On the question of data protection, the Court's language was unambiguous. The Court clarified that all collection, processing, storage, retention and sharing of personal data under the APAAR Scheme are subject to the Digital Personal Data Protection Act, 2023, and that student information cannot be disclosed to private entities or third parties except in accordance with law.
This ruling offers a compact fact pattern touching several distinct but connected doctrines examiners favour.
First, it operates squarely within the right to privacy framework established in Justice K.S. Puttaswamy v. Union of India, testing whether state action satisfies legality, legitimate aim, necessity, and proportionality, precisely the four-fold test the petitioners invoked here.
Second, it engages the Aadhaar jurisprudence on children, since Indian law has consistently resisted treating Aadhaar enrolment as compulsory for minors absent express statutory backing.
Third, it sits at the increasingly important overlap between constitutional privacy doctrine and the Digital Personal Data Protection Act, 2023, since courts are now beginning to operationalise DPDP compliance as a live remedy rather than treating it as a distant legislative promise.
Finally, the case illustrates an interesting appellate dynamic worth noting for constitutional law and jurisprudence sections: rather than laying down fresh law, the Supreme Court extended an unchallenged.
High Court direction across the country, a technique that CLAT PG aspirants should recognise as distinct from the Court exercising its Article 142 powers or reading down a statutory provision, since it instead rests on the simple logic that an unchallenged direction which serves the public interest deserves nationwide application.