In short. Websites must explain withdrawal before consent, allow it at any time as easily as consent, and stop the processing that relies on the withdrawn consent.
Definition: Under the General Data Protection Regulation (GDPR), visitors can withdraw consent to personal data processing at any time. A website must inform visitors of this right before they consent and make withdrawal as easy as giving consent, under Article 7(3).
Key facts
- The GDPR's Article 7(3) preserves the lawfulness of processing based on consent before withdrawal.
- The European Data Protection Board (EDPB), in its consent guidelines adopted on 4 May 2020, says consent given through a website must be withdrawable through the same electronic interface.
- The EDPB's Cookie Banner Taskforce report, adopted on 17 January 2023, identifies a permanently visible icon or a link in a visible, standard location as possible withdrawal controls.
What must visitors know before consenting?
The GDPR's Article 7(3) requires information about withdrawal before consent is given. Article 13(2)(c) also requires information about the right to withdraw at any time and the effect on the lawfulness of earlier processing when personal data is collected from the individual and processing relies on consent.
The EDPB's consent guidelines explain that transparency also requires information on how to exercise the right. An easy withdrawal process is a condition of a compliant consent mechanism.
Which withdrawal controls meet the requirement?
For cookies, the EDPB's taskforce report calls for an easily accessible solution displayed once consent has been collected. A floating icon can reopen privacy settings. A visible link in a standard location is another option. The report requires a case-by-case assessment of whether withdrawal is as easy as consent; it leaves the specific control to the website operator.
The EDPB's consent guidelines say that consent collected through a mouse click, swipe or keystroke must be equally easy to withdraw in practice. Withdrawal must be possible without detriment, including charges or reduced service levels. Switching to a different interface solely to withdraw consent creates undue effort.
What changes after withdrawal?
Under the GDPR's Article 7(3), withdrawal leaves the lawfulness of earlier consent-based processing intact. Article 17(1)(b) requires erasure when consent is withdrawn and there is no other legal ground for processing, subject to the exceptions in Article 17(3).
The EDPB's consent guidelines require the processing concerned to stop. They distinguish data retained for another purpose with an established lawful basis, such as performing a contract. The guidelines also prohibit retrospectively substituting legitimate interests to justify processing when consent proves invalid: the applicable basis must be determined before collection.
Related terms
FAQ
Can a telephone number be the only withdrawal route after online consent?
The EDPB's consent guidelines give an example of online ticket sales with marketing consent. Requiring you to call during business hours to withdraw consent breaches Article 7(3), because it is more burdensome than giving consent online through a mouse click.
Must every website use a floating cookie icon?
The EDPB's taskforce report accepts easily accessible solutions including a visible link. It says authorities cannot impose a particular withdrawal solution and must assess ease of withdrawal case by case.
Does withdrawal automatically make earlier processing unlawful?
The GDPR's Article 7(3) expressly preserves the lawfulness of processing based on consent before you withdraw it.
Sources
- European Union, "Regulation (EU) 2016/679", 27 April 2016
- EDPB, "Guidelines 05/2020 on consent under Regulation 2016/679", 4 May 2020
- EDPB, "Report of the work undertaken by the Cookie Banner Taskforce", 17 January 2023
Check how a page reads to answer engines. Open the GEO score analyzer