A user withdraws consent for analytics cookies, but the analytics scripts keep firing unchanged. What requirement is failing?
Select an answer to reveal the explanation.
Short Explanation
Hitting withdraw is supposed to actually stop the tracking—not leave the same scripts humming in the background. If the pixels keep firing, withdrawal was theatre. Make the off switch cut the power for real.
Full Explanation
Withdrawal of consent must be effective in practice. If a user withdraws consent for analytics cookies but analytics scripts keep firing unchanged, the controller has failed to implement withdrawal: the processing that depended on that consent must actually stop. Symbolic preference-centre theatre without technical cessation leaves the person under monitoring they refused and breaks the consent lifecycle that GDPR treats as continuous control, not a one-time click.
Withdrawal is not merely symbolic; technical cessation is required. Analytics cookies may not ignore withdrawal for a ninety-day “grace period.” Waiting for a supervisory authority to stop scripts is not the model—controllers must honour withdrawal themselves through engineering, contractual instructions to processors, and vendor control of tags and pixels.
Exam caveat: withdrawal equals technical stop, not a UI checkbox alone—an especially common cookie-banner trap. Operational check: wire consent platforms to tag managers and CMP signals, verify scripts and pixels cease on withdraw, re-test after tag releases, test across browsers and devices, and audit third parties that set tags. Civic websites should treat analytics opt-out as a real control residents can trust, documenting why continued firing after withdrawal was rejected as incompatible with honest public communication and accountable digital government.