Withdrawal of consent is a person's right to revoke their explicit consent at any time, without giving a reason. Withdrawal takes effect for the future: processing carried out on the basis of consent until that moment remains lawful, and processing stops afterwards. Under Article 7(3) of the GDPR, withdrawing consent must be as easy as giving it; letting visitors reopen cookie preferences at any time puts this principle into practice.
The validity of explicit consent depends on its revocability: an approval that cannot be undone from the moment it is given is not the product of free will. For this reason, consent can always be withdrawn under both the KVKK and the GDPR. The effect of withdrawal points forward: when a person revokes consent, processing carried out until that moment on the basis of consent remains lawful, but consent-based processing of the same data must stop from the moment of withdrawal. Article 7(3) of the GDPR completes this with an explicit rule: withdrawing consent must be as easy as giving it, and the person must be informed of this right beforehand.
In cookie banners this principle creates a concrete design requirement: after making their first choice, visitors must be able to return to the preference screen at any time through a permanent route, such as an icon in the page corner or a 'cookie preferences' link in the footer. If preferences become unreachable once the banner has closed, the ease requirement of Article 7(3) is violated. Technically, withdrawal requires two operations: recording the new preference and no longer writing cookies in the categories removed from the consent's scope. Storing the withdrawal date in the consent records also matters for the data controller's burden of proof.
Frequently asked questions
How can I withdraw the cookie consent I have given?
On a properly configured site you can return to the preference screen at any time: click the cookie icon in the page corner or the 'cookie preferences' link in the footer, untick the categories and save. The new preference applies immediately, and cookies in the removed categories are no longer written. You can also delete existing cookies manually in your browser settings. A site that offers no such route is effectively blocking the right of withdrawal.
What happens to data processed before consent was withdrawn?
Withdrawal takes effect for the future: processing carried out while consent was valid remains lawful and does not become unlawful retroactively. From the moment of withdrawal, however, consent-based processing must stop; if no other legal basis applies, there is no longer a justification for keeping the data. The person may additionally request deletion of their data where the conditions are met.
This content is for information only and is not legal advice.