Start free

CriticalChecked on every planEU

Tracking continues after consent is withdrawn

Do trackers have to stop when a visitor withdraws their cookie consent?

Short answer

Yes. People can take back consent at any time (GDPR, the EU privacy law). From that moment, non-essential tags must stop. France fined Orange €50 million partly for cookies read after consent was withdrawn.

16%of 168 European shops did this (27)
No. 3most common critical problem in the study

Why it matters

People can withdraw consent at any time, and from then on tracking must stop. France’s CNIL fined Orange and American Express partly because cookies kept being read after consent was withdrawn.

How to fix it

  1. Make the consent tool’s “withdraw” or “reject” action in the settings stop every non-essential tag, just like the first-layer reject.
  2. In Google Tag Manager, use consent-aware triggers so tags stop firing when consent changes, not only on the first page view.
  3. Delete or stop reading tracking cookies you control when consent is withdrawn.

The law behind this rule

EUGDPR Art. 7(3): withdrawing consent must be as easy as giving itEUePrivacy Directive Art. 5(3): cookies need prior consentEUCNIL cookie guidelines (2020): a way to withdraw, such as a “manage my cookies” link or icon, on every page

A plain summary, not legal advice.

Real case, anonymised

“Only necessary” on Didomi, and six ad tags still fired

Test Reject and withdrawal too. A banner can pass the first visit and fail both.
Read the case