After Withdrawal, When May the Banner Ask Again?

GDPR Article 7, paragraph 3, says the data subject shall have the right to withdraw consent at any time, and it shall be as easy to withdraw as to give consent. That is the whole rule on withdrawal, and it is short because it does not need to be long. As easy to withdraw as to give. One click to give, one click to take away.

The EDPB Guidelines 05/2020 add the detail: withdrawing must not require the person to do more than giving did, and it must not come with a penalty, a downgrade, or a nagging follow-up. The law says nothing about when the banner may ask again, and that silence is not permission. It is a gap, and the gap is filled by the same principle: the withdrawal has to mean something.

What the law actually says

The most common violation is also the most obvious. A visitor withdraws consent, the banner disappears, and on the next page load it is back, asking the same question again. The withdrawal lasted one page. The person has to withdraw again, and again, until they give up and click accept to make the banner stop.

That is not a consent flow. It is a war of attrition, and the business wins it by exhausting the visitor. CNIL guidance treats this pattern as a failure, because a withdrawal that the site immediately re-asks is not a withdrawal at all. It is a preference the site recorded and ignored.

The re-prompt that undoes the withdrawal

A defensible policy asks again only when something has changed: a new purpose, a new vendor, a new version of the banner that collects something the old one did not. The re-ask names the change, so the visitor can see why they are being asked again. 'We added a new analytics vendor' is a reason. 'You visited again' is not.

Set a floor in months, not page loads. Six months is a common choice, and a year is safer. The number matters less than the principle: the visitor's answer stands until the facts change, and the facts change when the processing changes, not when the visitor comes back.

A defensible re-ask policy

Every consent decision needs a record: who, what, when, which version of the banner, and what the scope was. The same applies to withdrawals, and the withdrawal record is the one that matters most, because it is the one an auditor or a regulator will ask for first.

Keep reading: Consent receipts: what to store and for how long, Consent mode v2 in practice: what actually fires before consent.

The record you keep

Store the withdrawal with a timestamp and the version of the banner it was given under, and keep it for as long as you keep the consent records. A withdrawal without a record is a claim the site cannot prove, and a re-ask that cannot show what changed is a re-ask without a reason.

Frequently asked questions

How easy must withdrawing consent be?

As easy as giving it, under GDPR Article 7, paragraph 3. One click to give, one click to take away. The EDPB Guidelines 05/2020 add that withdrawing must not require more effort than giving, and must not come with a penalty or a downgrade.

When can a site ask for consent again after withdrawal?

Only when something has changed: a new purpose, a new vendor, or a new banner version that collects something the old one did not. The re-ask should name the change. Asking again on the next page load undoes the withdrawal.

How long should a withdrawal stand?

Set a floor in months, not page loads. Six months is a common choice, and a year is safer. The visitor's answer stands until the facts change, and the facts change when the processing changes, not when the visitor returns.

What should a consent withdrawal record contain?

Who withdrew, what they withdrew from, when, which version of the banner the decision was given under, and the scope. Keep it as long as the consent records, because it is the record an auditor will ask for first.