India Boosts Aadhaar Authentication for Businesses: Navigating Privacy Concerns

India has recently eased restrictions on its Aadhaar authentication service, a comprehensive digital identity verification system that connects to the biometrics of over 1.4 billion individuals. This change will allow various businesses—including those in e-commerce, travel, hospitality, and healthcare—to utilize the Aadhaar verification framework to authenticate their customers. However, this update has sparked privacy concerns, as the Indian government has yet to establish clear regulations to prevent the potential misuse of individuals’ biometric data.

Overview of the New Aadhaar Amendment Rules

On Friday, the Indian Ministry of Information Technology introduced the Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Amendment Rules, 2025. This amendment revises the legislation originally enacted in 2020 following a Supreme Court ruling that limited private entities’ access to Aadhaar data. The current amendment arrives nearly two years after the Indian government initiated public consultations, although the feedback received remains undisclosed.

Objectives of the Amendment

The primary goal of the amendment is to enhance the scope and utility of Aadhaar authentication. According to the IT ministry’s press release, the updates will:

• Allow Aadhaar usage to improve service delivery.
• Enable both government and non-government entities to access Aadhaar authentication services for public interest initiatives.

Changes to Existing Regulations

Notably, the amended rules have removed the sub-rule that previously permitted Aadhaar authentication to prevent the “leaking of public funds.” This change significantly broadens the scope of unique ID-based verification provided by the Unique Identification Authority of India (UIDAI) and extends authentication services to various public and private sectors. Previously, Aadhaar authentication was mainly utilized by banking and telecommunications operators for customer onboarding and verification.

Transaction Growth

According to the UIDAI website, Aadhaar authentication transactions soared to 129.93 billion in January, a notable increase from 109.13 billion in February of the previous year. Major entities such as the National Informatics Center, National Health Agency, State Bank of India, Bank of Baroda, and Punjab National Bank are among the leaders in utilizing Aadhaar-based authentication for user verification this month.

Application Process for Aadhaar Authentication

Under the new rules, entities seeking to implement Aadhaar authentication must submit an application detailing their intended requirements to the relevant ministry or department of the Central or State government. The UIDAI and the Ministry of Electronics and Information Technology (MeitY) will evaluate these applications based on UIDAI’s recommendations.

Concerns Over Privacy and Misuse

Experts have raised significant concerns regarding the criteria that MeitY and UIDAI will use to evaluate applications. Kamesh Shekar, a digital governance expert at The Dialogue in New Delhi, emphasized the need for transparency to mitigate potential misuse, a concern highlighted by the Supreme Court during discussions on Section 57 of the Aadhaar Act.

Section 57 of the Aadhaar Act 2016 was invalidated by the Supreme Court in 2018, which initially allowed private entities to utilize Aadhaar numbers for identity verification. The Indian government amended the Aadhaar Act in 2019 to facilitate voluntary authentication, but this amendment is currently under challenge in the Supreme Court.

Risks Associated with Expanded Access

Prasanna S, an advocate in the Supreme Court who has fought for the Right to Privacy, noted that the recent amendment appears to “re-legislate” the previously struck-down Section 57. He expressed concern that the expansion of access could lead to increased risks of misuse.

Sidharth Deb, associate director for public policy at The Quantum Hub, highlighted the potential risk of exclusion associated with linking identity documentation to digital services. He urged for a clearer definition of “voluntary” access, emphasizing that citizens should maintain autonomy in accessing digital services seamlessly.

TechCrunch has reached out to the Indian IT ministry for clarification on the key concerns raised by policy experts regarding measures in place to prevent the misuse of Aadhaar and will update the article upon receiving a response.

For more information on Aadhaar and its implications, visit the TechCrunch website.