#The APAAR Reckoning: Supreme Court Forces an Opt-Out, and the DPDP Act Meets India's Biggest Children's Database

India's Supreme Court has told the government that a consent form which offers no way to say "no" is not a consent form at all. On July 20, 2026, a bench led by Chief Justice Surya Kant indicated it will direct the Central Board of Secondary Education (CBSE) to amend the model consent form for the APAAR student ID so that parents can explicitly refuse or opt out — a small drafting change with enormous consequences for a database that is meant to cover roughly 26 crore schoolchildren. It is the clearest signal yet that the DPDP Act's children's-data rules will be enforced against the state's own flagship digital-identity project, not just against private companies.

For any organisation that touches children's data in India — edtech platforms, schools, exam bodies, health apps, gaming and social media companies — the message is blunt: "voluntary" means nothing if the form only has a yes button. This is now a live constitutional question, and it maps directly onto the consent architecture the Digital Personal Data Protection Act, 2023 has been building toward all year.

#What actually happened on July 20

The case is a writ petition filed by the parents of four students (reported as Abhishek Baxi v. Union of India) challenging the constitutional validity of the APAAR scheme on the ground that it effectively compels children to obtain an Aadhaar number. APAAR — the Automated Permanent Academic Account Registry — assigns every student a permanent 12-digit academic ID intended to follow them from school through higher education, consolidating marksheets, credits and certificates into a single lifelong record. The government describes it as a voluntary initiative under the National Education Policy and the "One Nation, One Student ID" vision.

The petitioners' complaint was practical, not abstract: the APAAR consent form circulated to parents did not allow them to decline. You could agree, or you could leave the field blank and face administrative friction — but there was no clean, recorded "I do not consent" option. According to the hearing reports, the bench signalled it would direct CBSE to fix exactly this, aligning the model consent form with an earlier Orissa High Court order that had already required an explicit opt-out provision. The petition reportedly invokes the DPDP Act's consent provisions (Section 6) as part of its foundation (MediaNama, LiveLaw).

This did not come from nowhere. CBSE had already been forced to blink once. For the 2026 board examinations, the board allowed schools to submit the List of Candidates (LoC) without APAAR IDs — permitting "refused" or "not generated" entries — after schools flagged missing parental consent, wrong data and technical failures (Careers360). The July 20 development turns that ad-hoc relaxation into something closer to a principle: consent has to be real, revocable and recorded.

#Why a "voluntary" scheme ended up in the Supreme Court

The tension at the heart of APAAR is one the DPDP Act was written to resolve. A scheme can be labelled voluntary in a policy document and still be mandatory in practice — when the form has no "no", when a child's exam registration or scholarship depends on it, or when a school treats the ID as a default rather than a choice, the "consent" collected is coerced. That is precisely the kind of consent the DPDP Act refuses to recognise.

Under Section 6 of the Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and — critically — it must be as easy to withdraw as it was to give. A consent form engineered so that withdrawal is impossible or penalised fails that standard on its face. The Supreme Court's intervention essentially imports the statute's logic into the APAAR rollout ahead of the Act's own enforcement clock.

The scale is what makes this more than a procedural footnote. APAAR is designed to serve as a lifelong "academic passport" for around 26 crore students, with the broader ecosystem aiming to track close to 30 crore learners from school into higher education (Careers360). A consent defect replicated 26 crore times is not a paperwork problem. It is one of the largest children's-data processing operations on earth, running on a consent mechanism a High Court and now the Supreme Court have found wanting.

#The DPDP Act's children's-data rules, in plain English

To understand why this matters beyond the classroom, it helps to spell out what the DPDP framework demands when a child's data is involved. A "child" under the Act is anyone below 18 — a far broader net than the 13-year threshold familiar from many global regimes.

Verifiable parental consent is mandatory. Section 9 requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child's personal data. Rule 10 of the DPDP Rules, 2025 fleshes out how: fiduciaries must deploy technical means to confirm that the person granting consent is genuinely an adult and genuinely the child's parent or guardian — for instance by checking identity and age against a reliable token, a government-issued identifier, or an authorised identity service such as DigiLocker (DPDP Rules commentary, IDfy).

Profiling and behavioural targeting of children are banned outright. Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children — full stop, not subject to consent. A permanent academic ledger that follows a student for a lifetime sits uncomfortably close to the kind of longitudinal profiling the Act was designed to prevent, which is exactly the anxiety the petitioners have raised.

Schools get a narrow exemption — but not a blank cheque. The Rules do carve out relief for certain fiduciaries — schools and educational institutions, healthcare establishments, creches and child-transport services — from parts of the verifiable-consent and no-tracking requirements, precisely because they need to process children's data to function (Law.asia). But that exemption is conditional and bounded to what the institution legitimately needs. It does not authorise building a permanent, Aadhaar-linked national identifier and then declining to let parents opt out. The exemption covers the school's core educational function; it does not immunise a nationwide registry from consent scrutiny.

The through-line is consistent: even where the DPDP Act eases the mechanics for schools, it never converts a child's data into something parents cannot decline. The Supreme Court's push for an opt-out is that principle made concrete.

#The Aadhaar-linkage question underneath it all

The petitioners' sharpest argument is that APAAR, marketed as voluntary, functionally compels Aadhaar enrolment — because generating an APAAR ID leans on Aadhaar-based verification. That runs headlong into the Supreme Court's own 2018 Aadhaar jurisprudence, which restricted mandatory Aadhaar linkage for services and warned against making the number a precondition for benefits it was not designed to gate (Access Now analysis).

Layer the DPDP Act on top and the problem sharpens. If a child cannot get an academic ID — increasingly tied to exams, scholarships and admissions — without Aadhaar, the "consent" to Aadhaar processing is not free. It is the price of an education. The DPDP Act's insistence that consent be unconditional is fundamentally at odds with a design where saying no costs a student their academic record. This is the same broader debate now playing out in a separate ongoing hearing on whether citizens should have a right to delink or opt out of Aadhaar entirely, on which the bench is expected to reserve judgment later this year.

#What this means for Indian businesses and institutions

Do not read this as a story only about the government. The Supreme Court has just handed every Data Fiduciary a preview of how Indian courts and, soon, the Data Protection Board will read consent — and the standard is demanding.

If you process children's data, audit your consent flow now. Ask the uncomfortable question the petitioners asked CBSE: can a parent actually say no on your form, and is that refusal recorded and honoured? An edtech onboarding screen, a gaming sign-up, a coaching-app registration or a school-management SaaS that treats consent as a formality — checkbox pre-ticked, no withdrawal path — is now demonstrably out of step with both the statute and the judiciary. A functioning consent manager that captures affirmative opt-in, logs refusals and makes withdrawal one click is no longer a nice-to-have.

"Voluntary" is a legal claim you have to be able to prove. If your product or programme calls participation optional, the opt-out must be real, visible and consequence-free. Labelling something voluntary while engineering the interface so refusal is impractical is exactly the failure mode the court flagged. Regulators reading this ruling will treat dark-pattern consent — buried refusals, "consent or lose access" walls for non-essential processing — as a red flag.

Verifiable parental consent needs a real mechanism, not a self-declared tickbox. Rule 10 expects a genuine verification step. Firms serving under-18 users should be integrating identity- and age-verification now — via DigiLocker-based checks, guardian verification or an authorised token service — rather than relying on an honour-system "I am over 18" toggle. Build the plumbing before November, not after the Board's first inquiry.

Data minimisation and retention are the quiet risks. A permanent, lifelong identifier is the opposite of data minimisation. If your systems accumulate children's records indefinitely, revisit purpose limitation and retention. The DPDP Act does not reward hoarding; it penalises it, with breach and non-compliance exposure running up to ₹250 crore for the most serious safeguard failures.

#For parents and citizens: what changes

For the millions of families who received an APAAR form with no way to decline, the practical takeaway is that the "no" is coming — and it should be a clean, recorded refusal, not a blank field that invites follow-up pressure. If CBSE amends the model form as the court has indicated, schools will have to offer, accept and log an opt-out without penalising the student's exam registration or academic standing.

More broadly, this is the DPDP Act doing what it was sold to citizens as doing: giving individuals — and, for children, their guardians — genuine agency over whether the state and private actors get to build permanent profiles of them. A right to opt out is only meaningful if exercising it is free and doesn't quietly cost you something. That is the line the Supreme Court is drawing.

#The bottom line

The APAAR opt-out order is a small edit to a consent form and, simultaneously, a large statement of principle: in India, consent that cannot be refused is not consent, and children's data gets the strictest reading of all. The state is being held to the same standard it is about to impose on everyone else — and that symmetry is precisely what gives the DPDP Act its credibility as enforcement ramps up through late 2026.

If your organisation handles the personal data of anyone under 18, treat this week's development as your notice. Map every place you collect children's data, confirm that refusal and withdrawal are as easy as agreement, stand up verifiable parental consent that actually verifies, and document all of it. The court has just shown, on the government's own marquee project, that "we called it voluntary" is not a defence. Explore practical compliance building blocks in our resources hub and see how a purpose-built consent manager can turn these obligations into an audit-ready workflow before the Data Protection Board starts asking.

---

Sources: MediaNama — SC to direct CBSE on APAAR opt-out; LiveLaw — Supreme Court on APAAR consent forms; Careers360 — CBSE eases APAAR ID mandate for 2026 board exams; DPDP Rules 2025, Rule 10; IDfy — Protecting children's data under DPDP Rules; Law.asia — Children's data protection under the DPDP Act; Access Now — Supreme Court on Aadhaar.