Introduction:
In Abhishek Baxi v. Union of India [2026 LiveLaw (SC) 719], the Supreme Court addressed significant concerns relating to privacy, informed consent, and protection of children’s personal data under the Automated Permanent Academic Account Registry (APAAR) Scheme. A Bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohan observed that while digital initiatives in education may serve legitimate administrative objectives, they must operate within the constitutional framework that protects individual autonomy and informational privacy.
The petition was filed by parents of students studying in schools affiliated with the Central Board of Secondary Education (CBSE), challenging the constitutional validity of the APAAR Scheme. The petitioners contended that the scheme enabled the long-term collection, storage, and tracking of children’s educational records through a unique digital identification system linked to Aadhaar without ensuring meaningful parental consent. They argued that although the Ministry of Education had described parental consent as mandatory, the prescribed consent form failed to provide parents with an option to refuse participation, thereby rendering the consent process illusory.
The controversy gained further significance after CBSE issued circulars making APAAR registration a mandatory prerequisite for registration of students of Classes IX to XII for Board examinations from the academic year 2026 onwards. According to the petitioners, such a requirement indirectly compelled children to obtain an Aadhaar-linked identity despite earlier constitutional limitations imposed by the Supreme Court on mandatory Aadhaar enrolment for children.
Taking note of these concerns, the Supreme Court disposed of the petition by directing the Union Government and CBSE to amend the model consent form across the country so that parents and guardians are expressly given the option to withhold or refuse consent. The Court also reiterated that all personal data collected under the APAAR Scheme must be processed strictly in accordance with the Digital Personal Data Protection Act, 2023.
Arguments of the Parties:
The petitioners, represented by Senior Advocate Indira Jaising, argued that the APAAR Scheme effectively established a mechanism for continuous State monitoring of children’s educational journey through the creation of a permanent digital academic identity linked to Aadhaar. They submitted that such extensive collection and retention of personal information posed serious concerns relating to surveillance, profiling, and informational privacy.
It was contended that the Ministry of Education’s circular dated October 11, 2023 recognised parental consent as a prerequisite for generation of an APAAR ID. However, the consent form supplied to parents neither contained an option to refuse consent nor adequately explained the purpose for which the data would be collected, the categories of information sought, the duration of storage, or the circumstances in which the data could be shared. Consequently, the petitioners argued that the consent obtained under such circumstances could not be regarded as informed or voluntary.
The petitioners further submitted that the CBSE circulars dated August 5 and August 27, 2025 effectively made APAAR registration compulsory for students seeking to appear in Board examinations from 2026 onwards. Since the APAAR ID is linked with Aadhaar, they argued that this indirectly compelled children to enrol under the Aadhaar framework, contrary to the principles laid down by the Supreme Court in its Aadhaar judgment of 2018, which held that children cannot be forced to enrol for Aadhaar as a condition for availing educational benefits.
Reliance was also placed on the landmark judgment in Justice K.S. Puttaswamy v. Union of India (2017) recognising the right to privacy as a fundamental right under Article 21 of the Constitution. According to the petitioners, any State action involving collection and processing of personal data must satisfy the constitutional tests of legality, legitimate State purpose, necessity, and proportionality. They argued that the APAAR Scheme, in its existing form, failed to satisfy these constitutional requirements because it lacked adequate safeguards against excessive data collection, indefinite retention, and potential misuse of children’s information.
The Union Government and the CBSE defended the scheme by submitting that APAAR was introduced as part of the National Education Policy with the objective of creating a seamless digital academic ecosystem. According to the respondents, the unique academic identity would help maintain accurate educational records, facilitate transfer of students across institutions, simplify verification of academic credentials, and improve the efficiency of educational administration.
The respondents maintained that parental consent was already an integral feature of the scheme and that the information collected would be handled in accordance with applicable statutory safeguards. They also assured the Court that the authorities remained bound by the provisions of the Digital Personal Data Protection Act, 2023 while processing personal information collected under the scheme.
Court’s Judgment:
The Supreme Court recognised that consent lies at the heart of any framework involving collection and processing of personal information, particularly where children are concerned. The Bench observed that if parents are required to give consent, they must simultaneously be provided with a genuine opportunity to refuse such consent. A consent mechanism that offers only one choice—to agree—cannot be regarded as meaningful or informed.
The Court therefore accepted the reasoning adopted by the Orissa High Court in Rohit Anand Das v. State of Odisha (2025). In that decision, the High Court had directed the authorities to amend the model consent form by incorporating an express option enabling parents to decline participation in the APAAR Scheme. The Supreme Court held that this safeguard deserved nationwide implementation rather than remaining confined to a single State.
Accordingly, the Court directed the Union Government, the CBSE, and all authorities implementing the APAAR Scheme across India to amend the model consent form so that parents and guardians are expressly given the option to withhold or refuse consent. The Bench observed that such a safeguard is indispensable for ensuring that consent is both voluntary and informed, thereby preserving individual autonomy in matters involving children’s personal information.
The Court also considered the apprehension that extensive educational data collected under the APAAR Scheme could be vulnerable to misuse or unauthorised dissemination. It observed that the enactment of the Digital Personal Data Protection Act, 2023 imposes clear legal obligations upon every data fiduciary handling personal information. Consequently, every stage of data collection, processing, storage, retention, sharing, and utilisation under the APAAR Scheme must strictly conform to the provisions of the Act.
The Bench emphasised that educational authorities are legally bound to ensure secure, lawful, transparent, and purpose-specific processing of personal data. The Court made it clear that compliance with the statutory safeguards contained in the Digital Personal Data Protection Act is mandatory and not merely advisory.
Importantly, the Supreme Court categorically declared that personal information collected under the APAAR Scheme cannot be disclosed, shared, or otherwise made available to any private entity or third party except where authorised by law and strictly for purposes contemplated under the Scheme itself. Any disclosure beyond the authorised scope or for extraneous purposes would be impermissible.
While the Court did not strike down the APAAR Scheme or declare it unconstitutional, it recognised that digital governance initiatives involving children require robust procedural safeguards. The judgment strikes a careful balance between the State’s objective of modernising educational administration and the constitutional obligation to respect privacy, dignity, and parental autonomy.
The Bench also reaffirmed the broader constitutional principles governing informational privacy laid down in Justice K.S. Puttaswamy v. Union of India (2017). The recognition of privacy as a fundamental right requires every State policy involving personal data to operate with transparency, accountability, and proportionality. Even beneficial welfare or educational initiatives cannot dilute these constitutional guarantees.
By directing nationwide incorporation of an explicit opt-out mechanism and reinforcing statutory data protection obligations, the Supreme Court strengthened the concept of informed consent within India’s evolving digital governance framework. The decision makes it clear that technological advancement in public administration must remain consistent with constitutional values, particularly when the rights of children are involved.
In view of these directions, the Supreme Court disposed of the writ petition while directing the concerned authorities to implement the safeguards uniformly throughout the country. The judgment stands as an important reaffirmation that digital educational reforms must be accompanied by meaningful consent, robust privacy protections, and responsible data governance.