Consent Withdrawal: The Button You Have to Offer and Nobody Tests
Put a permanent, visible way to change consent on every page: a small icon, or a link in a standard place like the footer. Test it the way you test accept: one click, the preferences open, the change is recorded, and the tags stop. If withdrawal takes more effort than acceptance, the consent was never valid.
The half of consent nobody builds
Every consent banner is built for the first visit. Accept, reject, preferences, done. The second visit, the one where the shopper changes their mind, is where the system falls apart. GDPR Article 7(3) is short and absolute: it shall be as easy to withdraw consent as to give it. The EDPB's cookie-banner taskforce treated a missing withdrawal mechanism as a recurring failure mode, and the surveys back it up. NOYB's 2021 survey of cookie banners across the EU found only 18 percent offered an easy withdrawal mechanism. A scan of ten popular consumer sites in 2026 found none that offered a withdrawal path satisfying Article 7(3), and half shipped a reject path that visibly did not work: the trackers kept firing, the cookies persisted, and the only thing that changed was the banner disappearing.
The failure is easy to understand once you see it. The banner is a component owned by the CMP, and the withdrawal path is a feature nobody specified. The developer ships the banner, the lawyer approves the text, and the question of how a shopper changes their mind six months later never reaches either of them. The shopper who wants to withdraw is left with the same options as the shopper who wants to reject on the first visit: none, or a settings page buried in the footer.
What a working withdrawal path looks like
The EDPB taskforce names two acceptable patterns: a small, permanently visible icon, usually a cookie icon in a corner, or a link in a visible, standard place, usually the footer. Either works, and the choice is cosmetic. What matters is that it is present on every page, not only the homepage, and that it opens the same preferences the first visit showed, with the same options. The change must be recorded the same way the original choice was, with a timestamp and a version, and the tags must actually stop. A withdrawal that records the preference and keeps firing the tags is worse than no withdrawal at all, because it creates a record of a choice the site ignored.
Test it the way you test accept. Load the site, accept, then withdraw, and watch the network tab. The analytics and advertising requests should stop. Then reload and confirm the banner does not reappear and the preference holds. Then check the record: the withdrawal should be logged with the same detail as the consent. If any of those fail, the banner is compliant on the first visit and non-compliant on every visit after, which is most of them. The fix is usually configuration in the CMP, not development, and it takes less time than the argument about whether withdrawal matters. It does, and the regulators have said so in fines, not only in guidance. Withdrawal sits next to the GPC signal your banner has to honor and consent renewal under the CNIL's six-month rule.
Frequently asked questions
What does GDPR Article 7(3) require?
That it shall be as easy to withdraw consent as to give it. The data subject must be able to change their mind without more effort than the original choice took.
Where should the withdrawal option live?
On every page, as a small permanently visible icon or a link in a visible, standard place like the footer. It must open the same preferences the first visit showed.
How many sites actually offer easy withdrawal?
Very few. NOYB's 2021 survey found only 18 percent of EU cookie banners offered an easy withdrawal mechanism, and a 2026 scan of ten popular sites found none that satisfied Article 7(3).
What should happen when someone withdraws?
The tags should stop firing, the preference should be recorded with a timestamp and version, and the banner should not reappear on reload. A withdrawal that keeps the tags running is a record of a choice the site ignored.