India's APAAR student ID consent form faces scrutiny over data privacy

India's Ministry of Education has updated its consent form for the Automated Permanent Academic Account Registry (APAAR) system after a court directive in December 2025. The Odisha High Court ruled that the original form lacked a refusal option, violating the scheme's stated voluntariness and the right to privacy.

The APAAR system assigns students a unique ID linked to a DigiLocker account, intended to create a "lifelong digital academic record." This initiative is increasingly intersecting with data privacy concerns, particularly regarding the Digital Personal Data Protection Act (DPDPA) set to take full effect by May 2027. Section 9 of the DPDPA prohibits the tracking and behavioral monitoring of children, raising questions about routing academic records to talent identification or recruitment agencies.

The revised form now includes two boxes: one for consent and one for refusal, addressing the court's mandate for a clear opt-out. Previously, only a single consent option was available. The National Council of Educational Research and Training (NCERT) has also clarified that an APAAR ID is not mandatory for school admission. Despite these assurances, parents have reported facing pressure to enroll, and the act of refusing consent is recorded in the national UDISE+ database, potentially impacting a student's record.

An additional clause allows parents to consent to their child's academic data being used for "Scholarship Portals and value-added services such as Talent/Skill Identification Agencies (Recruitment)." This opt-in for recruitment purposes is a point of concern, as it could lead to minors' academic data being shared with commercial entities for scouting purposes, a practice that may conflict with privacy regulations concerning child data monitoring.

Parents retain the right to withdraw or modify their consent at any time by submitting a request to the school or the Data Protection Officer. The long-term implications of a "lifelong" digital record and how consent will be managed once a student reaches the age of 18, when they gain full control over their data, remain subjects for further clarification.