Withdrawing Consent Should Take One Click. Count Yours.
A tracking pixel collects personal data the moment an email is opened: the time, an IP address, and usually a device fingerprint, tied to an address you already hold. In the EU that collection needs a lawful basis and a clear notice before the first tracked send, and consent records that only mention the signup form do not cover it.
Article 7(3) of the GDPR states that withdrawing consent must be as easy as giving it. If accepting takes one click on the banner and withdrawing takes a settings page, a login, and a support form, the site is not meeting the standard. Count the clicks on both paths and fix the longer one first.
The rule, stated plainly
Consent under the GDPR has to be freely given, specific, informed, and shown through a clear affirmative action. Pre ticked boxes do not count, continued browsing is not consent, and the Court of Justice confirmed in the Planet 49 case that when the ePrivacy Directive requires consent for storing or accessing information on a device, that consent has to meet the GDPR standard. Article 7(3) then adds the symmetry rule: it must be as easy to withdraw consent as to give it.
Regulators have enforced the symmetry point with fines, not guidance notes. The French CNIL fined Google 150 million euros in part because rejecting cookies required several clicks while accepting took one. On September 1, 2025 the CNIL fined Google 325 million euros and Shein 150 million euros over cookies set without valid consent. The pattern in the decisions is consistent: the number of steps is the evidence.
Where withdrawal usually breaks
The common break is a settings page that exists but is hard to reach. The banner offers Accept All on the first layer, the reject option sits behind Preferences, and the withdraw link hides in a footer policy page that no visitor reads. A second break is the login wall: withdrawing consent requires an account the visitor may not have, or a support ticket that turns a one click act into a two day wait.
A third break is partial withdrawal. The visitor withdraws marketing consent and the site keeps the marketing tags firing because the tag manager condition checks a different variable than the consent platform writes. The consent record says withdrawn, the network panel says otherwise, and the gap is what an auditor screenshots.
The one click test, run this week
Open the site in a fresh browser. Accept all on the banner and count the clicks to that state. Then withdraw consent and count again, from the same starting page, without logging in. If the withdrawal path takes more clicks, more screens, or any step the accept path did not need, write down the exact count for each and hand it to whoever owns the consent platform.
Fix the longest path first, then retest with the tag manager in preview mode and confirm the tags actually stop. A withdraw control that records a choice and leaves the tags running is worse than no control at all, because the record claims a state the site does not honor.
Keep reading: Email Tracking Pixels Are a Consent Problem, Not a Privacy Footnote, What a Consent Audit Finds Inside the Tag Manager, and When Purposes Change, Consent Has to Be Asked Again cover the nearby cases in this series.
Frequently asked questions
Does the law really require equal ease for withdrawal?
Yes. GDPR Article 7(3) says it must be as easy to withdraw consent as to give it. Regulators have treated unequal click counts as the proof, and fines have followed where rejecting took several steps and accepting took one.
Can a site ask a visitor to log in before withdrawing consent?
Not if consent was given without a login. The withdrawal path has to match the giving path, so a visitor who consented anonymously must be able to withdraw anonymously, from the same device and browser.
What happens to data collected before withdrawal?
Withdrawal does not rewrite the past. Data collected while consent was valid stays governed by that consent, but processing that depended on consent has to stop from the withdrawal onward, and the record needs the withdrawal timestamp.
How often should a team test the withdrawal path?
After every release that touches the banner, the consent platform, or the tag manager, and on a quarterly cycle otherwise. Consent flows break through routine changes far more often than through deliberate decisions.