India makes Aadhaar more ubiquitous, but critics say security and privacy concerns remain

India is pushing Aadhaar, the world’s largest digital identity system, deeper into everyday private life through a new app and offline verification support, a move that raises new questions about security, consent, and the broader use of the massive database.

Announced in late January by the Indian government-backed Unique Identification Authority of India (UIDAI), the changes introduce a new Aadhaar app alongside an offline verification framework that allows individuals to prove their identity without real-time checks against the central Aadhaar database. 

The app allows users to share a limited amount of information, such as confirming that they are over a certain age rather than revealing their full date of birth, with a range of services, like hotels and housing societies to workplaces, platforms, and payment devices, while the existing mAadhaar app continues to operate in parallel for now.

Alongside the new app, UIDAI is also expanding Aadhaar’s footprint in mobile wallets, with upcoming integration with Google Wallet and discussions underway to enable similar functionality in Apple Wallet, in addition to existing support on Samsung Wallet. 

The Indian authority is also promoting the app’s use in policing and hospitality. The Ahmedabad City Crime Branch has become the first police unit in India to integrate Aadhaar-based offline verification with PATHIK, a guest-monitoring platform launched by the police department, aimed at hotels and guest accommodations to record visitors’ information.

UIDAI has also positioned the new Aadhaar app as a digital visiting card for meetings and networking, allowing users to share selected personal details via a QR code.

Officials at the launch in New Delhi said these latest efforts are part of a broader effort to replace photocopies and manual ID checks with consent-based, offline verification. The approach, they argued, is meant to give users more control over which specific identity information they want to share, while enabling verification at scale without having to query Aadhaar’s central database.

Early uptake on top of massive scale

While UIDAI formally launched the new Aadhaar app last month, it had been in testing since earlier in 2025. Estimates from Appfigures show that the app, which appeared in app stores toward the end of 2025, quickly overtook the older mAadhaar app in monthly downloads. 

Combined monthly installs of Aadhaar-related apps rose from close to 2 million in October to nearly 9 million in December.

The new app is being layered onto an identity system that already operates at enormous scale considering India’s population. Figures published on UIDAI’s public dashboard show that Aadhaar has issued more than 1.4 billion identity numbers and handles roughly 2.5 billion authentication transactions each month, alongside tens of billions of electronic “know your customer” checks since its launch. 

The shift toward offline verification does not replace this infrastructure so much as extending it, moving Aadhaar from a largely backend verification tool into a more visible and everyday interface.

At the app’s launch, UIDAI officials said the move toward offline verification was intended to address long-standing risks associated with physical photocopies and screenshots of Aadhaar documents, which have often been collected, stored, and circulated with little oversight.

The expansion comes at a time of regulatory changes, easing restrictions, and a new framework (PDF), with UIDAI now allowing some public and private organizations to verify Aadhaar credentials without querying the central database. 

Consent, accountability, and unresolved risks

Civil liberties and digital rights groups say those legal changes do not resolve Aadhaar’s deeper structural risks. 

Raman Jit Singh Chima, senior international counsel and Asia Pacific policy director at Access Now, said the expansion of Aadhaar into offline and private-sector settings introduces new threats, particularly at a time when India’s data protection framework is still being put in place.

Chima questioned the timing of the rollout, arguing that the federal government should have waited for India’s Data Protection Board to be established first, and allow for independent review and wider consultation with affected communities.

“The fact that this has gone ahead at this point of time seems to indicate a preference to continue the expansion of the use of Aadhaar, even if it is unclear in terms of the further risks that it might pose to the system, as well as to the data of Indians,” Chima told TechCrunch.

Indian legal advocacy groups also point to unresolved implementation failures. 

Prasanth Sugathan, legal director at New Delhi-based digital rights group SFLC.in, said that while UIDAI has framed the app as a tool for citizen empowerment, it does little to address persistent problems, such as inaccuracies in the Aadhaar database, security lapses, and poor mechanisms for redress, which have disproportionately affect vulnerable populations. 

He also cited a 2022 report by India’s Comptroller and Auditor General, which found UIDAI had failed to meet certain compliance standards.

“Such issues can often result in disenfranchisement of people, especially those who were meant to be benefited by such systems,” Sugathan told TechCrunch, adding that it remains unclear how data shared through the new app would prevent breaches or leaks.

Campaigners associated with Rethink Aadhaar, a civil society campaign focused on Aadhaar-related rights and accountability, argue that the offline verification system risks reintroducing private-sector use of Aadhaar in ways the Supreme Court has already explicitly barred. 

Shruti Narayan and John Simte of the group said enabling private entities to routinely rely on Aadhaar for verification amounts to “Aadhaar creep”, normalizing its use across social and economic life despite a 2018 judgment that struck down provisions allowing private actors to use Aadhaar to verify people’s information. They warned that consent in such contexts is often illusory, particularly in situations involving hotels, housing societies, or delivery workers, while India’s data protection law remains largely untested.

Together, the new app, regulatory changes, and expanding ecosystem are shifting Aadhaar from a background identity utility into a visible layer of daily life that is increasingly hard to avoid. As India doubles down on Aadhaar, governments and tech companies are watching closely, attracted by the promise of population-scale identity checks.

The Indian IT ministry and UIDAI CEO did not respond to requests for comments.