DPI Deep Dive — Monday | July 06, 2026

Theme: L1 — Identity & Authentication (UIDAI, Aadhaar, eKYC)

This week’s L1 deep dive is dominated by a single watershed moment: UIDAI’s retirement of the mAadhaar app and the launch of its successor. But beneath that headline lies a layered story of state governments weaponising Aadhaar eKYC for land records, regulatory ambiguity in how Section 7 of the Aadhaar Act applies to government certificates, and the approaching enforcement deadline of the Digital Personal Data Protection Act. Together, these developments reveal an identity infrastructure at an inflection point — more capable, more deeply embedded in governance, and more contested than ever.

1. The New Aadhaar App: End of an Era, Start of a New Chapter

On June 30, 2026, UIDAI formally retired the mAadhaar app — the mobile companion that had served as the primary resident-facing interface for Aadhaar services since 2017. In its place, a completely redesigned Aadhaar App went live on July 1, 2026, marking the most significant consumer-facing upgrade to India’s identity infrastructure in nearly a decade.

What’s New

The new app brings five headline capabilities:

1. Face Authentication: Residents can now verify their identity using facial recognition directly from their phone — no fingerprint scanner or iris device needed. This is a significant expansion of UIDAI’s multi-modal authentication stack (fingerprint, iris, face, OTP), and effectively makes every smartphone a potential authentication endpoint. For the vast majority of use-cases — hotel check-ins, office entry, SIM verification — this eliminates the need for dedicated biometric hardware.

2. QR Code-Based Identity Sharing: The app generates a secure, digitally-signed QR code containing the resident’s demographic data and photograph. This enables consent-based identity verification without exposing the Aadhaar number itself — a meaningful privacy improvement over the current practice of photocopying Aadhaar cards. The QR codes are validated against UIDAI’s digital signatures in real-time, making them tamper-proof.

3. Biometric Lock/Unlock: A one-tap feature that lets residents lock their biometrics (fingerprint, iris, and face) to prevent any unauthorised authentication attempts. When locked, all biometric authentications return error code 330, effectively freezing the resident’s biometric identity from being used without their explicit unlock. This is a critical anti-fraud measure — particularly relevant given the persistent problem of biometric data theft through cloned fingerprints or spoofed irises.

4. Free Email Updates via App (July–December 2026): In a major concession to resident convenience, UIDAI has enabled Aadhaar holders to update their email ID directly through the new app at no charge until December 31, 2026. Previously, email updates required a physical visit to an Aadhaar enrolment centre and attracted a ₹50 fee. UIDAI reported that over 2.5 lakh email updates were completed within the first 48 hours of the service going live — a clear signal of pent-up demand.

5. Digital Wallet: The app includes a digital wallet for storing downloaded e-Aadhaar and other identity documents, reducing dependence on physical copies.

Migration Strategy

UIDAI has opted for a phased transition rather than a hard cut-off. The old mAadhaar app will continue functioning temporarily while users migrate. UIDAI clarified that the app is “merely a service access point” — Aadhaar records are stored in the CIDR, not on the device — so no data is lost in the transition. State IT departments, including Bihar’s Department of Information Technology, have been actively encouraging citizens to switch via social media campaigns.

Analysis

The new app represents a strategic shift for UIDAI: from Aadhaar as a number to Aadhaar as a platform. Face authentication on a consumer app, QR-based verified identity sharing, and built-in biometric lock controls are not incremental updates — they represent UIDAI’s response to years of criticism that Aadhaar’s authentication model was too dependent on physical infrastructure (enrolment centres, registered devices) and too opaque for residents to manage their own privacy.

The free email update window is also noteworthy. UIDAI has historically charged for updates (₹50 for demographic updates at enrolment centres) — waiving this fee signals an understanding that friction in data updates is itself a security risk. Residents with outdated email IDs can’t receive OTPs, can’t lock their biometrics remotely, and are effectively locked out of self-service. Removing this barrier strengthens the overall security posture.

The cross-layer implications are significant. Face authentication on the Aadhaar App directly connects to L2 (Payments) — banks and fintech companies can now integrate face-based eKYC without deploying physical fingerprint scanners. It also connects to L3 (Documents) — the QR code sharing feature creates a verified digital credential that can substitute for physical Aadhaar copies in DigiLocker workflows. And for L4 (Commerce), face-based onboarding dramatically lowers the cost of KYC compliance for ONDC sellers and small merchants.

2. Haryana’s Paperless Registration 2.0: Aadhaar eKYC Meets Land Records

On June 24, 2026, Haryana Chief Minister Nayab Singh Saini inaugurated the Auto Mutation System and Paperless Registration 2.0 — a sweeping digitisation of the state’s property registration and land mutation process that makes Aadhaar-based eKYC, biometric authentication, and digital signatures mandatory for all parties involved.

How It Works

Under the new system, property registration and mutation (the process of updating land ownership records after a transfer) are integrated into a single workflow. Previously, buyers had to complete registration and then separately apply for mutation — often involving multiple visits to tehsil offices and weeks of processing time. With Paperless Registration 2.0:

• Aadhaar-based eKYC is mandatory for all buyer, seller, and witness identity verification
• Biometric authentication replaces manual identity verification by officials
• Digital signatures eliminate the need for physical document signing
• QR-coded registration documents provide tamper-proof, verifiable certificates
• Mutation happens automatically within 24 hours of registration completion

The system was developed over eight months with stakeholder feedback and represents the second iteration of Haryana’s paperless registration initiative.

Why It Matters

Land records are one of the most corruption-prone areas of Indian governance. The integration of Aadhaar eKYC with property registration directly addresses several fraud vectors: identity impersonation (where one person pretends to be another during property transfer), benami transactions (property registered under false identities), and manual record tampering by revenue officials.

The auto-mutation system is particularly significant because it removes the human discretion bottleneck. When registration and mutation are integrated, the ownership update is automatic — there’s no window for officials to delay mutations in exchange for bribes, or for fraudulent claims to be inserted between registration and record update.

Cross-Layer Connections

This sits at the intersection of L1 (Identity), L3 (Documents), and L6 (Governance). Aadhaar provides the identity anchor (L1), the paperless registration creates a digital document trail (L3), and the auto-mutation system is a governance reform that improves service delivery transparency (L6). It’s a textbook example of DPI layers combining to create systemic impact.

3. Regulatory Crosscurrents: Section 7 Ambiguity and DPDP Enforcement Timelines

Two regulatory developments this week highlight the tension between expanding Aadhaar’s use and strengthening privacy protections.

UIDAI Circular 6 of 2026: Section 7 Scope

UIDAI issued Circular 6 of 2026 (dated June 2, 2026) which withdrew Circular 5 of 2026 — a previous circular related to the applicability of Section 7 of the Aadhaar Act, 2016 during the issuance of government certificates. Section 7 is the provision that allows the government to mandate Aadhaar authentication as a condition for receiving subsidies, benefits, and services. The circular dance — first issuing guidance on when Section 7 applies to certificate issuance, then withdrawing it — suggests ongoing internal debate about the boundary between voluntary Aadhaar use and mandatory government requirements.

This matters because government certificates (birth certificates, caste certificates, income certificates) are often used as KYC documents for banking, SIM activation, and other private-sector services. If Aadhaar becomes mandatory for certificate issuance, it indirectly becomes mandatory for a much wider ecosystem of services — a chain of dependency that has been the subject of Supreme Court scrutiny.

Data Protection Board: Still Not Operational

The Data Protection Board of India (DPBI) — the enforcement authority under the Digital Personal Data Protection Act, 2023 — remains unconstituted as of late June 2026. The DPDP Rules were notified in November 2025, and the Board was expected to be operational by mid-2026, but no appointment notifications have been issued.

The timeline is now compressed: the Consent Manager framework is scheduled for operationalisation in November 2026, and full enforcement of all DPDP provisions (with penalties up to ₹250 crore) is expected by May 13, 2027. There is growing concern in compliance circles that the Board’s delayed constitution could create an enforcement vacuum — or trigger a rush of penalty actions once the Board becomes operational.

For the Aadhaar ecosystem specifically, the DPDP Act’s requirements around consent, purpose limitation, and data minimisation will directly impact how AUAs (Authentication User Agencies) collect, process, and store Aadhaar authentication data. The new Aadhaar App’s QR-based sharing and biometric lock features are well-aligned with DPDP principles — but the operational framework for enforcing these rights doesn’t yet exist.

4. The Persistent Shadow: Aadhaar Data in the Wild

Even as UIDAI strengthens resident-facing controls, the ecosystem’s perimeter vulnerabilities remain. A recent investigation highlighted that a Telegram bot called Hiteckgroop has been selling sensitive personal data of Indian residents — including Aadhaar numbers, PAN details, passport information, addresses, and family records — for as little as ₹2.50 per search using just a mobile number. The data has been traced to earlier breaches including BigBasket, Alien Text Base, and 1Win.

Separately, the Department of Telecommunications (DoT) revealed that through AI-driven analysis, it has flagged approximately 6.80 lakh mobile connections as potentially fraudulent, citing questionable veracity of Proof of Identity and Proof of Address documents submitted during KYC — many of which are Aadhaar-based. The Union IT Secretary also raised concerns about fraud and impersonation on platforms like Telegram and Signal.

These stories underscore a fundamental asymmetry in India’s identity infrastructure: the core system (CIDR, authentication APIs) is robust, but the data that flows out of it into the broader ecosystem remains vulnerable. UIDAI’s biometric lock and QR-based sharing features address the supply side — giving residents tools to control how their data is used at the point of verification. But they don’t address the demand side — the massive illicit market for PII that feeds on data leaked from third-party systems.

5. By the Numbers: Aadhaar at Scale

As of March 2026, the Aadhaar ecosystem stands at impressive but sobering scale:

• 144.57 crore Aadhaar numbers generated
• 17,990.86 crore cumulative authentications (including over 2,955 crore face authentications)
• Over ₹51.5 lakh crore transferred via Direct Benefit Transfer
• 50% of the world’s real-time digital transactions now originate in India, underpinned by Aadhaar-linked identity

These numbers reinforce that Aadhaar is no longer a “new” infrastructure — it is the foundational identity layer upon which India’s entire digital economy operates. The question is no longer whether Aadhaar works at scale, but whether the governance, privacy, and security frameworks around it are maturing at the same pace.

Cross-Layer Connections This Week

What to Watch

1. DPDP Board constitution: Once appointed, expect rapid enforcement guidance — particularly on how consent management intersects with Aadhaar-based authentication
2. New Aadhaar App adoption rates: UIDAI’s first real consumer product test — will 144 crore residents migrate?
3. State-level Aadhaar mandates: Haryana’s property registration model is likely to be replicated. Watch for similar eKYC mandates in driving licences, vehicle registration, and professional certifications
4. Section 7 litigation: The circular reversal suggests the legal boundaries are still being tested. Supreme Court intervention remains possible
5. Face authentication device ecosystem: As face auth goes consumer-grade, expect a wave of private-sector integrations — and a corresponding debate about liveness detection standards

Published as part of DPI Watch — tracking India’s Digital Public Infrastructure, layer by layer.