Consent Withdrawal
A user’s right to revoke previously given consent for data processing at any time, as easily as it was given.
Consent withdrawal is the right of individuals to revoke their consent to data processing at any time, as established by Article 7(3) of the GDPR. The regulation specifically states that it must be as easy to withdraw consent as it was to give it. This means if a user consented via a single click on a cookie banner, they must be able to withdraw that consent with similarly minimal effort — not by sending an email or navigating through multiple pages.
When consent is withdrawn, the organization must stop the relevant data processing promptly. For cookies, this means the CMP must delete or disable the cookies associated with withdrawn consent categories and stop loading the corresponding scripts. Processing that occurred before withdrawal remains lawful, but no new processing under that consent can continue. Organizations must provide a persistent and easily accessible way to manage consent preferences, typically through a cookie settings link in the website footer or a floating preferences button.