Withdrawal has to be as easy as agreeing
Article 7(3) GDPR contains a sentence that is broken almost everywhere in practice: withdrawal must be as easy as giving consent. Two clicks in, seven clicks out – that does not meet the requirement.
Withdrawal is not a special case but the second half of consent. Without it, agreement would be a one-off, final decision – and therefore something other than what the Regulation means by consent.
What a withdrawal has to trigger
- The processing stopsFrom now on, going forward. What happened lawfully before stays lawful – withdrawal has no retroactive effect.
- The stores are clearedCookies, local storage, IndexedDB – everything that rested on the withdrawn consent, and not only the cookies.
- Recipients are informedWhere data was passed on, the withdrawal has to travel there too. With Consent Mode that happens through the signals.
- The withdrawal is recordedWith a timestamp – as evidence of when the processing ended. The record of the earlier consent stays alongside it.
The standard for "as easy as"
Agreement happened via a banner that pushed itself to the front unasked and could be answered with one click. Withdrawal has to be possible by a comparable route: reachable from any page, without logging in, without a form, without an e-mail to an address that has to be hunted down first.
In practice that means a permanently visible entry point – usually a small button at the edge of the screen or an item in the footer that reopens the same choice.
Two routes back
What withdrawal does not do
- It is not retroactive. What happened until then stays lawful, provided the consent was valid.
- It does not replace an erasure request. Anyone wanting existing data removed too has to ask separately – withdrawal alone only ends further processing.
- It does not touch other legal bases. What rests on a contract continues – withdrawal concerns only what rested on the consent.
That last distinction has to be pointed out before withdrawal: Article 7(3) requires that the person be informed, before giving consent, that withdrawal is possible and what it does. A notice appearing only after the click comes too late.