Consider the following statements: 1. Aadhaar metadata cannot be stored for more than three months. 2. State cannot enter into any contract with private corporations for sharing of Aadhaar data. 3. Aadhaar is mandatory for obtaining insurance products. 4. Aadhaar is mandatory for getting benefits funded out of the Consolidated Fund of India. Which of the statements given above is/are correct?

1. Aadhaar metadata cannot be stored for more than three months. Incorrect. Under the Aadhaar Act/regulations, authentication transaction data could be retained for a longer period (about 6 months, and archives longer), so the 3-month limit is wrong.

2. State cannot enter into any contract with private corporations for sharing of Aadhaar data. Correct. Aadhaar core biometric information cannot be shared, and the State cannot lawfully contract away Aadhaar data to private entities.

3. Aadhaar is mandatory for obtaining insurance products. Incorrect. Aadhaar is not universally mandatory for buying insurance products.

4. Aadhaar is mandatory for getting benefits funded out of the Consolidated Fund of India. Correct. Section 7 of the Aadhaar Act permits requiring Aadhaar authentication for subsidies, benefits and services funded from the Consolidated Fund of India.

Therefore, statements 2 and 4 only are correct.