Consent withdrawal
Consent withdrawal is the right to take back consent at any time, and the law requires that withdrawing be as easy as giving it.Article 7(3) of the GDPR gives the data subject the right to withdraw consent at any time, says the withdrawal does not affect the lawfulness of what was done before, requires that the person be informed of this right before consenting, and sets the standard that it must be as easy to withdraw as to give consent. The EDPB's cookie banner task force translated this for websites in 2023: an easily accessible solution must exist on every page once consent has been collected, such as a small permanently visible icon or a link in a standardized place, although no specific widget can be imposed.
Authorities enforce it. The CNIL fined Yahoo 10 million euros in December 2023 partly because users who wanted to withdraw cookie consent were told they would lose access to their mailbox, which made the withdrawal not free.
In practice a banner needs a "Cookie settings" or "Manage consent" link in the footer or a floating icon that reopens the preferences center. On withdrawal the site must stop the scripts of the refused categories, delete the first-party cookies it controls, and send the updated signals to Google Consent Mode and to the tag manager. Third-party cookies set by other domains cannot be deleted by the site; the vendor is told through the consent signal. Each withdrawal also belongs in the consent log.