How to let visitors withdraw cookie consent (and what to do when they do)

GDPR gives everyone the right to withdraw consent at any time, and Article 7(3) requires withdrawal to be as easy as giving consent. For cookies, that means a link or icon on every page that reopens the consent choices in about the same number of clicks it took to accept. Then the site has to act on the new choice: stop tags, delete the cookies it set, update signals such as Google Consent Mode and log the change.

What does the law require?

Article 7(3) of GDPR sets four rules. People can withdraw consent at any time. Withdrawal does not make earlier processing unlawful. They must be told about the right before they consent. And withdrawing must be as easy as giving consent.

The EDPB’s Guidelines 05/2020 on consent spell out the last point: when consent is obtained electronically with one click, swipe or keystroke, people must be able to withdraw it equally easily. Withdrawing should also be free of detriment, so a visitor who changes their mind should not lose access to the site or be pushed through a longer process. Since ePrivacy borrows the GDPR definition of consent, the same rules apply to cookies.

How easy does withdrawal need to be?

Compare the paths. If accepting took one click on the first-layer banner, withdrawing should be roughly one click to open the choices and one to save them.

Withdrawal path	Is it as easy as giving consent?
Persistent “Cookie settings” link or icon on every page that reopens the preferences panel	Yes, the common approach
A “Reject all” or “Withdraw consent” button in that panel	Yes
A link only inside the cookie policy	Usually not, because it adds steps
Instructions to clear cookies in browser settings	No, it puts the work on the user
An email address or contact form	No, for consent given with one click

Put the link where people look for it, usually the site footer, and label it plainly. Reusing the same panel and controls as the original banner helps people recognize it. For more on banner layout, see cookie banner design best practices.

What should happen when someone withdraws consent?

Withdrawal has to change what your site does, not just what it stores. Work through these steps in order.

1. Store the new choice. Overwrite the stored consent state so every later page view reads the withdrawal.
2. Update downstream signals. Send a Consent Mode update with the affected types set to denied, and call the equivalent APIs for other vendors, such as fbq('consent', 'revoke') for the Meta Pixel.
3. Delete your first-party cookies and storage. Remove the non-essential cookies and browser storage keys that tags set on your domain.
4. Reload the page. Code that already ran cannot be unloaded, and some scripts keep timers, listeners or in-memory identifiers. A reload is the simplest way to start clean.
5. Tell your servers. If you use server-side tagging or send events from your backend, pass the new state there too.
6. Log it. Record the withdrawal with a timestamp and banner version, alongside your other proof of consent records.
7. Sync it for known users. If the visitor is logged in and you sync consent across devices, apply the withdrawal to their account.

Steps 2 to 4 might look like this:

function withdrawConsent(categories) {
  saveConsent(categories); // your consent store; categories now false

  gtag('consent', 'update', {
    analytics_storage: categories.analytics ? 'granted' : 'denied',
    ad_storage: categories.marketing ? 'granted' : 'denied',
    ad_user_data: categories.marketing ? 'granted' : 'denied',
    ad_personalization: categories.marketing ? 'granted' : 'denied',
  });
  if (!categories.marketing && window.fbq) fbq('consent', 'revoke');

  deleteCookies(/^_ga($|_)/, /^_gcl_/, /^_fbp$/, /^_fbc$/);
  localStorage.removeItem('analytics_client_id');

  location.reload();
}

How do I delete cookies from JavaScript?

Set the cookie again with the same name, path and domain it was created with, and an expiry in the past. The catch is that document.cookie does not tell you a cookie’s domain or path, so try the likely combinations:

function deleteCookies(...patterns) {
  const names = document.cookie
    .split('; ')
    .map((pair) => pair.split('=')[0])
    .filter((name) => patterns.some((re) => re.test(name)));

  // Analytics tools often set cookies on the parent domain (".example.com")
  const labels = location.hostname.split('.');
  const domains = [''];
  for (let i = 0; i < labels.length - 1; i++) {
    domains.push(`; domain=.${labels.slice(i).join('.')}`);
  }

  for (const name of names) {
    for (const domain of domains) {
      document.cookie = `${name}=; Max-Age=0; path=/${domain}`;
    }
  }
}

Three limits are worth knowing. Cookies marked HttpOnly cannot be removed from JavaScript, so delete them from the server with a Set-Cookie header. Cookies set with a path other than / need that path. And cookies on a vendor’s own domain cannot be deleted by your site at all, so the best you can do is stop loading the vendor’s code.

What about data already collected?

Withdrawal does not undo the past, but it affects what you keep. Once consent is withdrawn, you have to stop processing that relied on it. If you have no other lawful basis for data already collected, the EDPB expects you to delete it, and GDPR’s right to erasure covers the same situation.

For analytics and advertising data held by vendors, check what deletion tools they offer, such as user deletion APIs, and include them in your process for logged-in users whose identity you know. For anonymous visitors, stopping further collection is usually what you can realistically do.

Bottom line

Make withdrawal a one-click path from every page, then make it real: store the choice, update Consent Mode and vendor APIs, delete your first-party cookies and storage, reload, inform your servers and log it. Do not prompt the visitor again right away. Tools like Cookiesh include a preference center where visitors can change their choices, send the matching Consent Mode update and log every change, including withdrawals.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.