In a significant ruling on student privacy and data protection, the Supreme Court of India has directed the Central Board of Secondary Education (CBSE) to amend its APAAR (Automated Permanent Academic Account Registry) ID consent forms to provide parents with a clear option to refuse consent or opt out of the scheme. The direction seeks to reinforce the voluntary nature of APAAR and follows an earlier judgment of the Orissa High Court, which held that parents must be given an explicit choice before their children’s data is enrolled in the academic identity system.

The order comes amid growing concerns over the collection, storage and processing of children’s personal data and the linkage of APAAR IDs with Aadhaar, raising important questions about privacy, informed consent and digital governance in education.

A Bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V. Mohan was hearing a petition filed by parents of four students challenging the constitutional validity of the APAAR scheme.

Parents raise privacy concerns over APAAR and Aadhaar linkage

The petitioners argued that although the government describes APAAR as a voluntary initiative, it functions as a mandatory requirement in practice because it is linked to Aadhaar and is increasingly associated with various academic processes.

Appearing for the petitioners, Senior Advocate Indira Jaising contended that compelling children to obtain Aadhaar-linked academic identities violates their constitutional right to privacy. Referring to the Supreme Court’s landmark K.S. Puttaswamy v. Union of India (2019) judgment, she argued that children cannot be forced to obtain Aadhaar numbers for accessing educational services.

The petition further questioned the legality of collecting and processing children’s personal information without ensuring meaningful and informed parental consent.

Supreme Court to implement Orissa High Court ruling nationwide

During the hearing, the Bench noted that the Orissa High Court, in a judgment delivered in December 2025, had already addressed the issue of consent.

The High Court had ruled that if APAAR is genuinely voluntary, the consent form must explicitly allow parents to decline participation at the very beginning instead of assuming consent. It directed authorities to revise the consent form by incorporating a clear opt-out option.

After being informed that the Orissa High Court’s decision had not been challenged, the Supreme Court observed that the ruling should be implemented across the country.

According to the Bench, CBSE will be directed to implement the High Court’s directions on a pan-India basis, ensuring that parents nationwide receive the option to either consent to or refuse the generation of an APAAR ID for their children.

CBSE circulars subject to Data Protection Act

While discussing the larger objectives of the APAAR initiative, the Chief Justice observed that the scheme aims to create a unique academic identity for students, maintain lifelong academic records, improve curriculum implementation and help authorities monitor educational indicators such as teacher-student ratios.

However, the Court also acknowledged the petitioners’ contention that even legitimate policy objectives must be pursued through lawful, proportionate and constitutionally compliant mechanisms.

The Bench clarified that CBSE’s implementation of APAAR will remain subject to all applicable laws, including the Digital Personal Data Protection Act, 2023, which governs the collection, storage and processing of personal data.

What the ruling means for parents and schools

The Supreme Court’s direction reinforces that participation in the APAAR scheme cannot be presumed through a one-sided consent process. Schools affiliated with CBSE are expected to revise their consent forms to provide parents with an explicit choice to opt out, ensuring that consent is informed and voluntary.

The detailed order is expected to be uploaded by the Court, after which CBSE will be required to implement the revised consent mechanism across the country.

The ruling is likely to have significant implications for student data governance, digital identity initiatives in education and the implementation of privacy safeguards in schools, while reaffirming the importance of parental consent in matters involving children’s personal information.