Aadhaar offline verification seeks to reconcile ease of identity verification with the right to privacy. Critically examine.

Offline verification was introduced by the Aadhaar and Other Laws (Amendment) Act, 2019. It verifies a resident without authentication, meaning there is no live check against UIDAI's central database [2]. UIDAI had onboarded 300 Offline Verification Seeking Entities (OVSEs) by November 2026 [1]. The framework largely reconciles convenience with privacy, but its enforcement is weak.

Ease of verification

• Paperless and instant: the QR code on the Aadhaar letter, e-Aadhaar, PVC card or m-Aadhaar can be scanned [3]. This cuts onboarding costs in hospitality, healthcare, education and the gig economy [1].
• No biometric exclusion: CAG found authentication failure rates of up to 49% in some states [4]. A QR scan does not depend on fingerprints worn down by manual work.
• Self-service: the Aadhaar App has nearly 7.5 crore downloads and over 86 lakh mobile updates [1].

Privacy safeguards

• Data minimisation: OVSEs must not collect, use or store the Aadhaar number or biometrics [2]. Any stored copy must be masked [3]. This is far safer than photocopy-based KYC.
• Consent and non-denial: consent must be explicit and recorded for audit. Service cannot be refused if the resident has another way to identify themselves [3].
• User control: the App recorded 4.6 crore biometric lock/unlock transactions, and the framework is described as aligned with the DPDP Act [1].

Limitations

• Invisible to the regulator: there is no central log. The only record is the OVSE's own consent log [3], so the entity being watched holds the evidence.
• Weak oversight record: CAG Report No. 24 of 2021 found that UIDAI did not vet the systems of requesting entities and received no audit reports from its partners [4].
• Self-reporting: the 72-hour misuse-reporting rule relies on the OVSE reporting itself [3].
• A lighter route: under the 2025 Good Governance Amendment Rules, private entities need ministry approval to use authentication [5]. OVSEs from the same sectors need only UIDAI onboarding [1].
• De facto compulsion: privacy locks are opt-in, and no data is published on refusals or misuse [1]. Front-desk staff may not offer residents an alternative.

On balance, offline verification is a real privacy gain over photocopies and makes verification easier. To make it work in practice, UIDAI should:

• audit OVSEs before onboarding them;
• check samples of their consent logs every year;
• publish data on refusals and misuse;
• keep a public list of approved entities for both routes;
• make privacy settings the default.

These steps would bring it in line with the right to privacy under Article 21.