Summary
The Supreme Court has directed the CBSE and all authorities running the APAAR scheme to add a pan-India opt-out option to the consent form used for collecting children's Aadhaar details. The bench, led by CJI Surya Kant, adopted an Orissa High Court direction and ruled that all data collected must comply with the Digital Personal Data Protection Act, 2023.
The court rejected the argument that APAAR being an administrative scheme, not a statutory one, exempted authorities from data-fiduciary obligations.
WHY IN NEWS FOR UPSC & STATE PCS
The order settles a live constitutional challenge to APAAR, which parents had called a state-run surveillance mechanism enabling long-term tracking of children's educational data, by making refusal of consent a mandatory, standardised option nationwide rather than a scheme-by-scheme discretion.
Standard News
WHY "ADMINISTRATIVE SCHEME" STOPPED BEING A LOOPHOLE
The Supreme Court's most important line in this order isn't about Aadhaar or opt-out boxes at all. It's this: "merely because the collection of such information is undertaken pursuant to an administrative scheme and not under a statutory mandate does not absolve the authorities of their obligations in relation to the protection of personal data." That sentence closes a gap the government had been quietly relying on for years.
The Gap the Court Just Closed The Digital Personal Data Protection Act, 2023
was written with statutory data collection in mind - schemes backed by an Act of Parliament, with defined purposes and defined penalties for misuse. APAAR was never legislated. It exists as an administrative initiative under the National Education Policy, run by the Ministry of Education through executive circulars, not a Parliamentary statute.
That distinction mattered, because it let the government argue, implicitly, that a scheme people could technically decline was different in kind from a scheme people were legally compelled to join - and so didn't need the same fiduciary discipline.
The Court rejected that distinction outright: the DPDP Act's obligations attach to the processing of personal data, not to the legal instrument that authorised its collection.
What Makes Consent "Meaningful"
- The Actual Test This is where the opt-out order does its real work. A scheme can be formally "voluntary" and still functionally coercive if the only form parents are given has no box to say no - that was precisely the petitioners' argument and the Court agreed by name-checking Section 9 of the DPDP Act, which requires verifiable parental consent for a child's data, not merely a form that assumes consent by default. Voluntary participation without a refusal option is not informed consent under Article 21's privacy jurisprudence from Puttaswamy - it's consent by omission and omission is not the same as agreement. The state remains free to run APAAR. What it has lost is the ability to treat "administrative, not statutory" as a lower-obligation category. Every data fiduciary - Ministry of Education included - now answers to the same DPDP standard, whether the scheme behind the data collection was passed by Parliament or issued as a circular. For an aspirant, the exam-relevant point isn't "the Supreme Court protected children's privacy," which is the headline-level reading. It's narrower and sharper: the Court has foreclosed a specific administrative-law argument - that non-statutory schemes sit outside the DPDP Act's fiduciary obligations - that governments could otherwise use across dozens of other e-governance initiatives built the same way APAAR was.
Quick Facts
The Supreme Court bench comprised CJI Surya Kant, Justice Joymalya Bagchi and Justice V Mohana. The order was passed on July 20, 2026 and made public on July 25. It extends an Orissa High Court direction from the case Rohit Anand Das vs State of Odisha, decided in December 2025.
APAAR stands for Automated Permanent Academic Account Registry, also called One Nation One Student ID. All data collected under APAAR must comply with the Digital Personal Data Protection Act, 2023.
Connect the dots for your UPSC preparation.
Standard news covers the event. Log in to read our comprehensive analysis and uncover the hidden constitutional, structural, and ethical dimensions of this topic:
How this ruling could be cited against other non-statutory digital ID schemes beyond education - and which ones are structurally most exposed to the same challenge.
The specific reasoning connecting Section 9's "verifiable parental consent" standard to what actually makes a consent form legally adequate versus merely present.
Why the Court invoked Puttaswamy rather than the DPDP Act alone to strike down the "administrative scheme" defence and what that layering signals for future privacy litigation.
The full case study on how the Orissa High Court's single-state ruling became a pan-India mandate and what that route reveals about horizontal precedent-setting in Indian courts.
Included in this analysis
Join thousands of aspirants analyzing the news deeply.
Log In to Read Full ArticleDon't have an account? Sign up for free