Withdrawal must be as easy as consent

The DPDP Act gives people the right to withdraw consent at any time, and says the ease of withdrawing should be comparable to the ease of giving consent. One sentence, and it changes a lot of everyday design decisions.

If a visitor agreed with one click on a banner, withdrawing should not need an email to a support address, a login they have forgotten, or a phone call during office hours. This post looks at what "as easy as giving it" means on each channel a typical Indian business uses, and at the part most businesses miss: making the withdrawal actually reach every tool.

A simple test: count the steps#

The most useful way to think about this is to count. How many steps did the person take to say yes? How many does it take them to say no?

• Banner: one click on "Accept all". Withdrawal should be no more than one link and one click.
• Form: one ticked box at checkout. Withdrawal should not need a support ticket.
• WhatsApp: one tap on a button. Withdrawal should be one reply.
• Front desk: one QR scan and an OTP. Withdrawal should not need a visit to the clinic.

If the "no" path is longer than the "yes" path, it is worth fixing.

On your website#

A cookie or consent banner usually appears once. After that, people need a way back to their choices. Two things help:

• A permanent link. A small "Privacy choices" link, floating on the page or in the footer, that reopens the same panel where the person made their choice. It should be visible on every page, not hidden in the privacy policy.
• Equal buttons. "Accept all" and "Reject all" should look the same: same size, same weight, same colour. If reject is a faint grey text link, withdrawing will always feel harder than agreeing.

The OptProof widget does both by default: the floating link always reopens the preference panel, and withdrawing everything takes one click, the same as granting everything.

In a preference centre#

Some people want to see everything they have agreed to in one place, across the website, the app and the shop counter. A preference centre does that. The person verifies themselves with a one-time code sent to their phone or email, sees each purpose with its current status, and switches any of them off.

Two design rules matter here. Each purpose gets its own switch, so withdrawing from marketing does not cancel an appointment reminder they still want. And there is a "withdraw all" option for people who simply want out.

In your own forms#

Many businesses capture consent inside their own forms, for example a "Send me offers on WhatsApp" box at checkout. That is good practice, because consent is collected at the moment the data is collected. It also creates a trap.

Imagine a returning customer who agreed to offers last month. Today they fill the checkout form again and do not tick the box, perhaps because they did not notice it. Did they just withdraw?

The safer answer is no. An unticked box should never silently withdraw an earlier consent. Leaving a box empty is not a clear action, so it should not cancel a clear action the person took before. Withdrawal should be something the person does on purpose, through the link or the preference centre. OptProof's inline form block follows exactly this rule: unticked boxes are recorded as refusals only for purposes that were not already granted.

On WhatsApp#

WhatsApp is often where Indian businesses talk to customers most, so it is where people most often want to stop hearing from them. If someone agreed by tapping a button in a WhatsApp message, they should be able to stop just as easily, for example by replying STOP or tapping an opt-out button.

The hard part is not receiving the STOP. It is making sure every list and campaign tool respects it. A STOP that reaches the WhatsApp inbox but not the broadcast list used next week is a withdrawal on paper only.

At the front desk#

Clinics, gyms, schools and property offices collect a lot of consent in person. A patient who gave consent by scanning a QR code at reception should not have to come back to the clinic to withdraw it.

Give people a receipt they can use later. With OptProof, the person sees their receipt on screen when they consent at a QR standee or a kiosk, and gets it by email when they confirm with their email address. The receipt code lets them open their preferences from home and change their mind.

The part most businesses miss: propagation#

A withdrawal is only real when it reaches every place the data is used. In a typical small business, that might be:

• the CRM (Zoho, HubSpot or a spreadsheet)
• the email tool (Mailchimp, Brevo)
• the online store (Shopify)
• one or more WhatsApp lists
• an Excel sheet someone downloaded three months ago

If the consent tool records a withdrawal but nobody updates the email tool, the next newsletter still goes out. From the customer's point of view, nothing changed.

There are two ways to close this gap:

1. Webhooks. Every consent change produces a signed event that your own systems receive within seconds. Your developer decides what to do with it, such as suppressing the contact in the mailing list.
2. Connectors. For common tools, the work is already done. When someone withdraws, the connector sets the opt-out flag in your CRM, unsubscribes them in your email tool, or updates the marketing consent on the customer record in your store.

OptProof offers webhooks from the Starter plan and connectors from the Growth plan, because in our experience this is where consent programmes fail. The goal is that a withdrawal reaches connected tools within minutes, not at the next quarterly clean-up.

For the systems no connector can reach, such as that downloaded Excel sheet, keep a short checklist and work through it when a withdrawal or erasure request arrives.

Keep a record of the withdrawal too#

A withdrawal is itself something you may need to prove. If a customer complains that you messaged them after they opted out, you will want to show when the withdrawal arrived and what you did next.

In OptProof, a withdrawal is a new event in the ledger with its own signed receipt. The earlier consent receipt stays valid as a record of what happened at the time, and the verifier shows that it has been superseded.

What withdrawal does not undo#

Withdrawing consent does not make earlier processing unlawful. If someone agreed to reminders in March and withdrew in June, the reminders sent in April were fine. What changes is what you do next: stop the processing that relied on consent, and delete the data for that purpose unless the law requires you to keep it.

Some data may still have to be kept for other reasons. A clinic must keep treatment records for a minimum period; a business must keep tax invoices. The withdrawal ends the optional purposes, such as marketing or reminders, not those legal duties.

A quick checklist#

• Count the steps to say yes and to say no on every channel.
• Put a permanent "Privacy choices" link on every page.
• Make reject and accept buttons look the same.
• Never treat an unticked box as a withdrawal of an earlier consent.
• Honour STOP on WhatsApp across every list.
• Send people a receipt link they can use to change their mind later.
• Connect your CRM, email tool, store and WhatsApp lists so withdrawals arrive automatically.
• Keep a checklist for the systems you cannot connect.