Consent withdrawal in one click: the Article 7 test

Give consent on most sites and it takes one click. Take it back and it takes an email to support, a form with three fields, and a confirmation that arrives in a day or two. That gap is the whole of GDPR Article 7(3), which says it must be as easy to withdraw consent as it is to give it, and that the data subject must be informed of the right before giving consent. A one click give and a support ticket take-back is not a small friction. It is the exact failure the article was written to catch.

The test is mechanical, and it takes two minutes. Give consent the way a visitor does, and count the clicks. Then withdraw it the way a visitor does, and count the clicks. If the second number is larger than the first, the site fails Article 7(3). If the withdrawal requires an email, an account, or a phone call, the site fails by a distance, because the law requires equivalence, not a reasonable effort.

What Article 7 actually requires

Article 7 has four conditions, and they apply cumulatively. The controller must be able to demonstrate that consent was given, which is the record keeping duty. The request must be clearly distinguishable from other matters, in clear and plain language. Withdrawal must be as easy as giving consent, at any time. And consent must be freely given, which means the service cannot be conditional on consent to processing that is not necessary for it. Meeting three out of four is not sufficient. Any failure invalidates the consent entirely.

The EDPB Guidelines 05/2020 on consent spell out what equivalence means in practice. If consent is given with a single click on a banner, withdrawal should take a single click in the same place, or in a place just as easy to find. A withdrawal link buried in a privacy policy, three pages from the banner, is not equivalent. A footer link that opens a preference centre where the visitor has to find the right toggle is closer, but only if the toggle is one click and the change is immediate.

Where sites fail, in order

The most common failure is the missing withdrawal path. The banner has an accept button and a reject button, and then nothing. No footer link, no preference centre, no way back. The visitor who changes their mind has nowhere to go, and the site has no record of a withdrawal that never happened, because it never gave the visitor a way to make one.

The second failure is the preference centre that makes withdrawal harder than consent. The banner offers one click to accept all. The preference centre offers a list of vendors, each with its own toggle, and no reject all button. Withdrawing consent for twenty vendors takes twenty clicks, and that is not equivalence by any reading. A reject all control is not a courtesy. It is the mechanism that makes withdrawal as easy as consent.

The third failure is the delay. A withdrawal that takes effect in 24 to 48 hours is a withdrawal that lets processing continue for a day or two after the visitor said stop. The consent platform should apply the change immediately, and the tags should respect it on the next page load at the latest. A queue is not an excuse.

The fix to ship this week

Add a persistent withdrawal control in the footer, labelled in plain language, that reopens the same banner the visitor first saw. Make sure the banner has a reject all control that works in one click. Test the round trip: give consent, withdraw it, and check that the tags stop and the record updates. Count the clicks both ways. If the numbers match, the site passes the test. If they do not, the fix is a control, not a policy, and it is a small one.

Keep reading: Consent banner reopen links and footer placement, Consent records and the retention period.

Frequently asked questions

What does GDPR Article 7 say about withdrawing consent?

Article 7(3) says the data subject can withdraw consent at any time and it must be as easy to withdraw as to give consent. If consent takes one click, withdrawal should take one click, in a place just as easy to find.

Is a footer link enough for consent withdrawal?

It can be, if it reopens the same banner and the banner has a reject all control that works in one click. A link buried in a privacy policy, or a preference centre with twenty toggles and no reject all, is not equivalent to a one click accept.

How quickly should withdrawal take effect?

Immediately. The consent platform should apply the change at once and the tags should respect it on the next page load at the latest. A withdrawal that takes 24 to 48 hours lets processing continue after the visitor said stop.

Does the EDPB say anything specific about this?

Yes. The EDPB Guidelines 05/2020 on consent explain that withdrawal must match the ease of giving consent, and that a withdrawal mechanism requiring more effort than the original consent is not compliant.