The new Aadhaar App represents a shift from centralised identity verification to resident-controlled credential sharing. Critically examine its implications for privacy, governance, and digital inclusion in India.

Dedicated to the nation on 28 January 2026, UIDAI's new Aadhaar App lets residents carry, share and update identity from a smartphone [2]. Crossing 31 million downloads in under five months [1], it marks a pivot from database-lookup verification to resident-controlled disclosure — a genuine advance, though its gains are uneven.

Privacy: strengths

• Selective credential sharing through customised QR codes lets a resident reveal only the fields a use-case needs, operationalising data minimisation under the DPDP Act [2].
• Biometric lock/unlock in one click and face verification for proof of presence curb misuse of stored biometrics [2].
• Authentication history gives residents an audit trail — answering the privacy safeguards demanded in K.S. Puttaswamy (2018) [2].

Privacy: limits

• Consent remains device-level; a shared family handset (up to five profiles, "One Family–One App") dilutes individual control [2].
• Aadhaar's core database still holds ~134 crore live records with 17,000+ crore authentications, so centralised risk is reduced at the edge, not removed [3].

Governance

• Self-service updates — ~4 million mobile-number and ~8.5 lakh address changes [1] — cut dependence on enrolment centres and CSCs, easing administrative load.
• Offline QR verification at hotels, hospitals and for gig-worker onboarding extends assurance without server calls [1].
• Yet a larger install base widens the attack surface, and grievance redress for failed digital updates remains thin.

Digital inclusion

• Adoption scale [1] and multi-profile design help low-device-penetration households.
• However, the model presumes a smartphone, data and digital literacy — excluding precisely the elderly, rural and migrant users [1] most reliant on Aadhaar-linked entitlements; assisted-mode channels must therefore continue.

The App advances privacy-by-design and citizen agency, but inclusion depends on the offline ecosystem it must not displace. Sustaining assisted enrolment channels, strengthening DPDP-aligned grievance redress and periodic security audits would let this shift deepen dignity and equality under Article 21 rather than create a new digital divide.