The reopen link in the footer: the smallest consent feature with the longest memory

Article 7 of the GDPR sets the condition in one sentence: it shall be as easy to withdraw consent as to give it. Giving consent on most sites takes one click on a banner that appears uninvited. Withdrawing it often takes a search for a footer link, a visit to a privacy page, and in the worst cases an email to a privacy inbox. Regulators have treated buried withdrawal paths as a compliance failure in their own right, separate from whatever the banner does.

The footer link is the standard remedy because the footer is where visitors have been trained to look for privacy controls. It must be labelled in the visitor's vocabulary: cookie settings or privacy choices, not consent management centre or any phrase a legal team invented. Test findability the crude way: ask someone outside the team to change their cookie choice on your site and time them.

As easy to withdraw as to give

A reopen link that lands on a page of prose about how much you value privacy, with toggles nowhere in sight, fails the purpose while wearing its clothes. The link should trigger the banner's preference panel itself, or a settings page carrying the same categories, the same current states shown accurately, and a save that takes effect immediately, including stopping the tags the visitor has just switched off.

Current state display matters more than it looks. A settings panel that opens with every toggle reset to off, or to on, regardless of the stored choice, teaches visitors that their previous decision was never recorded, and invites them to distrust every other privacy claim on the site. Read the stored consent, show it faithfully, then let them change it.

Reopen the real interface, not a leaflet

Footer links die in redesigns because they belong to no team. The consent link is usually wired to a script call from the consent platform, and a rebuilt footer that keeps the words but loses the trigger ships a link that does nothing. Add the reopen link to the release checklist as a functional item, clicked and verified, not a visual one. A dead consent link is worse than a missing one, because it demonstrates the path was promised and abandoned.

Keep the link alive through redesigns

Keep reading: Consent Records Retention: How Long to Keep Proof of a Yes, Alternatives to Cookiebot.

Frequently asked questions

Where should the consent reopen link go?

In the footer of every page, beside the privacy policy link, labelled in plain words like cookie settings. That is where visitors look for privacy controls, and the link must be present site wide, not only on the privacy page itself.

What law requires an easy withdrawal path?

The GDPR states that withdrawing consent must be as easy as giving it. A one click banner paired with a buried or email only withdrawal route fails that symmetry, and regulators have treated obstructed withdrawal as its own violation.

Should the reopen link show my current choices?

Yes, accurately. The settings panel should read your stored consent and display the real state of each category before you change anything. A panel that resets toggles regardless of your stored choice misrepresents the record and destroys trust in the system.

What should happen when I withdraw consent through the link?

The change should save and take effect immediately: the relevant tags stop and storage is cleared or blocked going forward, without a page visit to a help article or an email to anyone. If saving requires further steps, the path is not as easy as the banner was.