Taking consent back

If you ask for a “yes”, visitors must be able to take it back. Before they choose, make clear that they can do this at any time, and how.

Withdrawal must be

Requirement	What it means
Available any time	Visitors can withdraw whenever they want
Free	No charge for withdrawing
No downside	Withdrawing has no negative consequences for the visitor
As easy as giving it	No more effort than the original consent took
Reachable outside the banner	e.g. a floating button always in view, or the top of the cookie policy

Don't

• Hide how to take it back until after the choice
• Make people go looking for it
• Charge or punish people for taking it back
• Forget to tell the other companies (third parties) when someone takes it back

Tip

You don’t have to use the exact words “withdraw consent”. Other wording is fine, as long as the visitor understands that this is what happens. In the authority’s example, a small triangle-with-a-C icon in the bottom-left corner opens the settings.

If your “yes” also covers other companies (third parties), you must tell them when someone takes it back. See the Dutch privacy authority’s separate guidance for detail.