After a customer withdraws marketing consent, a preference centre silently re-checks the consent box on the next login without a clear new affirmative action. How should that practice be treated?
Select an answer to reveal the explanation.
Short Explanation
Withdrawing consent should not feel like a revolving door that sneaks back open when you are not looking. Quietly re-ticking the box after someone said no is not real consent. Fresh consent needs a clear yes, and stopping must be as easy as starting.
Full Explanation
After withdrawal of marketing consent, silently re-checking the consent box on the next login without a clear new affirmative action is invalid. Withdrawal must be as easy as giving consent, and any fresh consent requires a clear affirmative act that is specific and informed. Quiet restoration of consent treats withdrawal as temporary UI state rather than a binding stop, undermining freeness and unambiguous agreement and inviting complaints that the organisation never really listened.
Silent re-checking is not allowed merely because marketing volume stays under one email per week. Historical consent does not make withdrawal powerless; withdrawal stops reliance on that consent going forward for the purposes withdrawn. Preference centres may not auto-restore consent whenever a cookie banner refreshes; each new consent needs a real opt-in the person understands.
Exam caveat: post-withdrawal “gotcha” re-ticking is a classic invalid-consent pattern on CIPP/E scenarios. Operational check: persist withdrawal flags server-side, prevent default re-selection on login, require explicit re-opt-in with timestamps and purpose labels, and audit login and banner flows after releases. Civic portals should honour a resident’s “stop” without sneaking consent back through interface resets—public trust depends on sticky respect for withdrawal.