Supreme Court Directs Centre, CBSE To Amend APAAR Consent Form To Give Opt-Out/Refuse Option; Restricts Third-Party Sharing Of Data

The Supreme Court recently directed the Union Government and the Central Board of Secondary Education to amend the model consent form prescribed under the Automated Permanent Academic Account Registry (APAAR) Scheme to expressly provide an option enabling parents or guardians to withhold or refuse consent.

A bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V Mohana observed that the directions contained in paragraph 19 of an Orissa High Court judgment in Rohit Anand Das v State of Odisha(2025) should be given effect to on a pan-India basis by the authorities implementing the APAAR scheme.

In paragraph 19, the High Court had directed: "Thus, from a conspectus of the analysis made hereinbefore, this Court finds that the Petitioners have made out a good case for interference by this Court. Resultantly, the Writ Petition is allowed. The opposite party-authorities are directed to consider amendment of the model consent form to include an opt out/refusal of consent option therein. The model consent form incorporating such changes as provided by learned counsel for the Petitioners to the learned DSGI may also be considered. Necessary orders in this regard shall be passed within two months from today."

In giving this direction, the Supreme Court stressed that an option for allowing parents to opt out is an essential safeguard that the requirement of consent is expressed and well-informed: "We are of the considered view that such a safeguard is essential to ensure that the requirement of consent is meaningful and informed. Accordingly, we direct that the directions contained in paragraph 19 of the aforesaid judgment shall be given effect to on a pan-India basis by the concerned authorities implementing the APAAR Scheme."

The bench was hearing a petition filed by parents of students enrolled in schools affiliated with the Central Board of Secondary Education challenging the constitutionality of the APAAR scheme. The aggrieved parents, through Senior Advocate Indira Jaising, contended that the APAAR scheme effectively operates as a State-run surveillance within the education sector as it enables the long-term tracking, profiling and monitoring of children's educational developments without allowing parents to opt out of it. 

They were mainly aggrieved by the fact that the scheme allows for extensive collection and retention of data, which has the potential to be used beyond the educational sphere. The parents therefore had communicated to their respective schools, refusing to consent to the generation of an APAAR ID.

Jaising had also pointed out that as per a Ministry of Education's circular dated October 11, 2023, parental consent was a prerequisite, but the prescribed forms neither provide an option to decline participation nor disclose, in a clear and informed manner, the purpose, scope or retention period of the information so collected.

Moreover, the CBSE, through its two circulars dated August 5, 2025, and August 27, 2025, has made the registration of APAAR ID a mandatory precondition for registration of students of Classes IX to XII for Board examinations commencing from academic year 2026 onwards.

Since the APAAR ID is linked to Aadhaar, the compulsion to obtain it essentially means a compulsion to enrol in the Aadhaar program, which, as per the Supreme Court's 2018 judgment, cannot be imposed on children.

In substance, Jaising urged that the measures fail to satisfy the tests of legality, legitimate aim, necessity and proportionality governing State action and therefore infringe the fundamental right to privacy as held in Justice K.S. Puttaswamy judgment(2017).

Follow Data Protection Act; Don't share data to third parties

The bench also dealt with the contention that the data so collected can be misused. The Court observed that there was duty on the part of the authorities to protect personal data as per the Digital Personal Data Protection Act, 2023.

"Any collection, processing, storage, retention, sharing, or use of personal information under the APAAR Scheme shall, therefore, be strictly governed by the provisions of the Digital Personal Data Protection Act, 2023, and the obligations cast thereunder upon data fiduciaries to ensure the lawful, secure, and purpose-limited processing of personal data. The concerned authorities shall obviously ensure scrupulous compliance with the safeguards prescribed under the said enactment."

Additionally, the bench stated that personal information collected under the APAAR scheme can't be disclosed, shared, or otherwise made available to any private entity or third party.

"It goes without saying that any personal information collected pursuant to the APAAR Scheme cannot be disclosed, shared, or otherwise made available to any private entity or third party except in accordance with law and strictly for purposes authorized thereunder. Any sharing of such information beyond the scope of the Scheme or for extraneous purposes shall be impermissible."

With the aforesaid directions, the petition was disposed of.