Withdrawing consent only works if every system that uses it stops. Publish one withdrawal event from a single consent service, make each downstream consumer acknowledge it, and check at the point of use rather than trusting a copied flag. Article 7 requires withdrawal to be as easy as giving consent.
Why withdrawals leak
Consent is usually captured in one place and used in many: the email platform, the analytics tool, an ad audience export, a data warehouse, a CRM. Each holds its own copy of "opted in". When the user withdraws, one copy updates and the rest keep going until the next sync, if there is one.
Article 7(3) says the person can withdraw at any time and that it shall be as easy to withdraw as to give consent. The ICO adds that you should stop the processing as soon as possible and that withdrawal must not carry a penalty.
Pattern 1: one source of truth
Keep consent state in a single service, built from the event log. Other systems either call it at the moment of use, or receive a pushed event and cache the result briefly.
Checking at the point of use is safest. Before sending a marketing email, before adding someone to an audience, before loading an analytics script, ask the consent service. A short cache of seconds or minutes is fine. A copy that lives for weeks is not.
Pattern 2: publish and acknowledge
For systems you cannot call live, such as a vendor, publish a consent.withdrawn event and require an acknowledgement. Track:
- Event ID and subject.
- Consumer name.
- Acknowledged at, or not acknowledged yet.
Alert on events that stay unacknowledged beyond a threshold you choose. Silence is the failure mode.
Pattern 3: handle the already exported
Data sent out before withdrawal may sit in ad audiences, partner lists and exports. Maintain a list of every recipient that receives consent based data, and give each a removal path: an API, a file upload or a support route. Article 19 expects the controller to tell recipients about erasure, subject to impossibility or disproportionate effort.
Do not delete the evidence of withdrawal
You will often need a small suppression record, such as a hashed email, so you do not message the person again. The ICO guidance accepts suppression records for direct marketing, provided you tell people and have a basis for it. Keep that separate from marketing data.
Test it
Write a test that withdraws consent for a test account and then checks each system:
- Does the email platform refuse to send?
- Does the audience export exclude the account?
- Does the analytics script stop loading on next page view?
- Is the event acknowledged by every consumer?
Run it on a schedule, not once.
Quick check
Does withdrawal make past processing unlawful?
No. Article 7(3) says withdrawal does not affect the lawfulness of processing before it.
Can I switch to legitimate interests after someone withdraws?
The ICO says you cannot swap to a different lawful basis for the same processing once consent is withdrawn. Take legal advice before trying.
Sources
Last reviewed: 19 October 2026.
