Withdrawing consent — as easy as giving it, by law (Art. 7(3))

Art. 7(3) is short and lethal: consent can be withdrawn at any time, withdrawal must be as easy as giving consent, and you must be told this before consenting. What withdrawal hits: everything that ran on consent — marketing, cookies, photo permissions, optional profiling, “share with partners” ticks. Processing before withdrawal stays lawful; continuing after it is a violation per se. What it doesn’t hit: processing on other bases — the contract still needs your address to deliver, tax law still keeps invoices. Companies love blurring this line; ask “on which Art. 6 basis does this processing continue?” and watch the blur resolve. The as-easy-as test in practice: one-click subscribe demands one-click unsubscribe; consent given in an app must die in the app, not via a phone hotline; cookie consent needs a withdrawal control as reachable as the banner was (the settings link most sites hide in the footer — that hiding is itself challengeable, and dark-pattern rules back you up). Template line: “I withdraw all consent under Art. 7(3) GDPR with immediate effect. Confirm which processing you have stopped, and on which legal basis anything continues.” Pair with the absolute marketing objection and the loop is closed.