The Kerala High Court (Ernakulam Bench) has held that Aadhaar-based OTP authentication for online Tatkal booking through the IRCTC platform is not liable to be struck down where the Railways has shown a legitimate objective of preventing manipulation, bulk booking and misuse of the system, and where the measure is presented as operating within the statutory framework of the Aadhaar Act with privacy safeguards. The Court effectively held that, in these facts, the policy survives scrutiny even under the proportionality standard because it is justified by the need to regulate access and ensure fair availability of Tatkal tickets to genuine users.
The Court also laid down that where an online authentication measure is challenged on privacy grounds, the existence of an offline alternative without such authentication may weigh with the Court in assessing whether the measure is truly compulsory or disproportionate. Here, the availability of offline Tatkal purchase without Aadhaar was an important factor in sustaining the scheme.
The Division Bench comprising the Chief Justice Soumen Sen and Justice Syam Kumar V.M. noted the petitioner’s privacy challenge, but placed significant weight on the fact that Aadhaar authentication for online Tatkal booking was not an absolute compulsion in the larger sense because offline Tatkal tickets remained available without Aadhaar authentication. The Court also took note of the Railways’ justification that the policy was introduced based on past instances of deceit, manipulation and bulk booking in the Tatkal system.
The Court accepted the respondents’ case that the policy had a rational objective and was connected with controlling misuse of the Tatkal system. It observed that since the online authentication requirement had been introduced for a legitimate purpose and had a stated basis in past experience of abuse, the wisdom of that decision could not be treated as unjustified even when tested on the touchstone of proportionality. In other words, the Court found that the policy had a reasonable justification and did not warrant interference in judicial review.
At the same time, the Court found merit in the petitioner’s submission that PAN card authentication might also achieve a similar result. The judges observed that PAN-based OTP authentication may also serve the same purpose because PAN-based transactions too involve OTP generation before the transaction is permitted. On that basis, the Court indicated that IRCTC could consider allowing either Aadhaar or PAN card for authentication.
Briefly, a public interest litigation was filed challenging the Ministry of Railways’ 10 June 2025 notification that introduced Aadhaar-based OTP authentication for Tatkal ticket booking through the IRCTC website and mobile application. The petitioner argued that this requirement was contrary to law, disproportionately affected the right to privacy and informational autonomy, and did not actually solve the real technical and infrastructure problems affecting the Tatkal booking system. The petitioner also pointed out that before 10 June 2025, there was no such Aadhaar-based OTP requirement even for Tatkal bookings.
The Union of India, Railway authorities, CRIS and IRCTC defended the policy through their affidavits. Their case was that the measure was introduced to ensure that only genuine individual users access the Tatkal system and to curb bulk booking by touts, syndicates and automated software, which had caused serious hardship to the public. According to them, the policy was meant to improve fairness, transparency and accountability in access to Tatkal tickets.
The respondents further stated that the Aadhaar authentication framework operates within the Aadhaar Act, 2016 and related regulations. They said authentication is done only with informed user consent, through encrypted communication channels, and on data minimisation principles, with the response being limited to a yes/no confirmation or e-KYC information. They also maintained that neither IRCTC nor the Railways stores the Aadhaar number, that the requesting entity does not access the Aadhaar database, and that UIDAI exercises regulatory and security control over the process.
Also Read Allahabad HC Partly Modifies ₹219.97 Crore Arbitral Award in UPSHA-Abhijeet Toll Road Dispute
IRCTC also explained that Aadhaar authentication was intended to enforce a one person, one booking discipline, reduce multiple accounts and speculative access attempts, and filter abusive or high-frequency requests before they burden the seat allocation system. It admitted that Aadhaar authentication does not itself increase server capacity, improve coding efficiency or enhance bandwidth, but argued that the system’s performance depends not only on infrastructure supply but also on controlling artificial demand created by multiple accounts, proxies and automated access.
The Railways also clarified an important operational point before the Court. Aadhaar authentication was said to be required only for the IRCTC user and not for all passengers booked through the user’s account. It was also clarified that the authentication is a one-time exercise and need not be done before every booking. Further, persons who do not possess Aadhaar or do not wish to use it can still purchase Tatkal tickets physically at railway counters, where no Aadhaar authentication is required.
