Biometric authentication is central to India's welfare delivery architecture, yet raises questions of consent and data protection. Discuss.

Biometric authentication under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 has become the identity backbone of India's welfare state [1]. Its scale delivers efficiency and inclusion, but the same architecture tests the limits of informed consent and data security.

Centrality to welfare delivery

• Scale: Aadhaar authentication crossed 2,707 crore transactions in FY 2024-25, enabling e-KYC, DBT and PDS lifting at the last mile [2].
• Inclusion through technology: AI/ML-based Face Authentication crossed 200 crore transactions by August 2025, doubling in six months — a contactless option for those with worn fingerprints, such as manual labourers and the elderly [3].
• Deduplication and leakage control: unique biometric identity curbs ghost and duplicate beneficiaries in subsidy rolls.
• Widening use: piloted with NTA and NIC for candidate verification in NEET UG 2025, showing extension beyond subsidies into public examinations [4].

Concerns of consent

• Consent is often coerced in effect: where authentication is the only practical route to rations or pensions, refusal means exclusion — despite Justice K.S. Puttaswamy v. Union of India (2018) holding that benefits cannot be denied for want of Aadhaar [5].
• Function creep: expansion into exams, attendance and private-sector onboarding stretches the original purpose to which citizens consented.
• Low digital literacy limits genuinely informed consent among the poorest — precisely the welfare-dependent group.

Concerns of data protection

• Biometrics are immutable; unlike a password, a leaked face or fingerprint template cannot be reset.
• Spoofing risk is officially acknowledged: UIDAI has invited solutions against deepfakes, mask attacks and presentation attacks in face authentication [6].
• Authentication failure causes wrongful exclusion, converting a technical error into denial of entitlement.
• The Digital Personal Data Protection Act, 2023 creates duties for data fiduciaries, but its operational strength depends on effective enforcement [7].

Biometric authentication is thus an enabler, not an end. The way forward lies in guaranteed non-biometric fallback options, purpose limitation, robust liveness detection, and time-bound grievance redress. Aligned with the Puttaswamy standard of proportionality and SDG-16's promise of legal identity for all, technology can serve entitlement rather than gatekeep it.