Privacy Tools Guide

Aadhaar collects ten fingerprints, two iris scans, face photos, and demographic data for over 1.4 billion Indians. The UIDAI (Unique Identification Authority of India) stores this biometric data in centralized servers with documented security breaches. Developers integrating Aadhaar APIs should use minimal e-KYC verification, never store raw biometric data, and users should monitor whether their Aadhaar has been leaked through dark web monitoring. Understand your legal rights to access or delete your Aadhaar data under India’s emerging data protection laws.

What Biometric Data Aadhaar Collects

During enrollment, Aadhaar captures several types of biometric data beyond just your photograph:

The biometric data gets processed through Unique Identification Authority of India (UIDAI) servers. Critically, the original biometric images are not stored—only templates, which are mathematical representations designed to be irreversible.

# Example: How biometric matching works conceptually
# UIDAI uses proprietary template matching algorithms
# This is pseudocode to illustrate the concept

def match_biometric(query_template, stored_template, threshold=80):
    """
    Compare query biometric against stored template
    Returns match score percentage
    """
    # Proprietary UIDAI algorithm (not public)
    match_score = compute_similarity(query_template, stored_template)
    return match_score >= threshold

How Aadhaar Data is Stored and Protected

UIDAI claims several security measures:

  1. Encryption: Data is encrypted using AES-256 both in transit and at rest
  2. Template conversion: Raw biometric images convert to irreversible templates
  3. Regional servers: Data supposedly stored across multiple data centers
  4. Access logging: Every authentication request gets logged

However, security researchers and privacy advocates have raised concerns:

# Checking Aadhaar authentication status (unofficial method)
# Developers can test API responses but should NOT store any Aadhaar data

curl -X POST https://auth.uidai.gov.in/public/v2/liveness-detection \
  -H "Content-Type: application/json" \
  -d '{
    "uid": "XXXXXXXXXXXX",
    "bio-subtype": "FMR",
    "device-id": "DEVICE123"
  }'

Who Can Access Your Aadhaar Data

The access model has evolved, and several entities can query the Aadhaar database:

Government Agencies

Private Entities

Authentication Types

UIDAI provides different authentication methods:

Method Use Case Risk Level
Biometric High-security transactions High (fingerprint/iris required)
OTP Mobile verification Medium
Demographic Basic verification Lower
Liveness Detection Prevents replay attacks Improved security 
// Understanding Aadhaar API authentication flow
// For developers integrating with UIDAI services

const aadhaarAuth = {
  method: 'biometric', // or 'otp', 'demographic'
  uid: 'XXXXXXXXXXXX', // 12-digit Aadhaar number
  deviceId: 'unique-device-identifier',
  timestamp: new Date().toISOString(),

  // For OTP-based auth
  otp: async (uid) => {
    const response = await fetch('https://uidai.gov.in/api/v2/auth/otp', {
      method: 'POST',
      body: JSON.stringify({ uid })
    });
    return response.json();
  }
};

Known Privacy Incidents and Concerns

The Aadhaar system has faced multiple security incidents:

  1. 2017-2018 breaches: Multiple reports exposed Aadhaar data through third-party websites
  2. 2019 Tribune investigation: Reporters purchased complete Aadhaar data for $8
  3. Biometric bypass: Researchers demonstrated ways to bypass fingerprint authentication
  4. Service usage tracking: Every Aadhaar authentication creates a timestamped log

TheUIDAI maintains that no biometrics were compromised in these incidents, but critics argue the centralized nature of the database creates inherent risks.

What Developers Need to Know

If you’re building applications that interact with Aadhaar:

  1. Never store Aadhaar numbers: Only process and forward, never retain
  2. Use official APIs only: Third-party Aadhaar verification services may be illegal
  3. Implement consent mechanisms: Users must explicitly consent to Aadhaar verification
  4. Understand liability: Under the Aadhaar Act, you’re responsible for data handling
# Best practice: Don't store Aadhaar data in your database
# Instead, use stateless verification

class AadhaarVerification:
    def __init__(self):
        self.uidai_api = "https://uidai.gov.in/api/v2/auth"

    def verify_without_storing(self, uid, auth_type):
        """
        Verify Aadhaar and immediately discard after confirmation
        Never persist the Aadhaar number
        """
        # Process verification
        result = self._authenticate(uid, auth_type)

        # Critical: Don't store result with PII
        # Return only verification status
        return {
            'verified': result['success'],
            'timestamp': result['txnId']
            # Note: Do NOT return the UID
        }

Protecting Your Privacy as a User

For individuals concerned about Aadhaar privacy:

# Lock your biometric data via UIDAI portal
# This prevents anyone from using your biometrics
# Access: https://resident.uidai.gov.in/biometric-lock

# You can also lock via SMS:
# Send "LOCKUID <12-digit-uid>" to 1947

# To unlock temporarily for authentication:
# Send "UNLOCKUID <12-digit-uid>" to 1947

The Bigger Picture

Aadhaar demonstrates both the promise and pitfalls of national digital identity systems. For developers, understanding the technical architecture helps build compliant applications. For users, knowing who accesses your data and how to protect yourself is essential.

The tension between convenience (improved KYC, direct benefit delivery) and privacy (surveillance potential, data breach risks) remains unresolved. As a developer, advocate for privacy-preserving practices. As a user, exercise the controls available to you.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides