Definition
Consent withdrawal is a fundamental right under GDPR that allows individuals to withdraw their consent to data processing at any time. In email marketing, when a subscriber withdraws consent, you must stop processing their data for the purpose they originally consented to — typically receiving marketing emails.
Consent withdrawal is distinct from unsubscribing. Unsubscribing stops future emails while retaining data. Consent withdrawal requires you to also evaluate whether you have a lawful basis to continue holding and processing their data.
Consent Withdrawal vs Unsubscribe
| Action | Effect | Legal Basis Change |
|---|---|---|
| Unsubscribe | Stops future marketing emails | Data retained under legitimate interest for suppression |
| Consent withdrawal | Consent is revoked | Must stop processing unless another lawful basis applies |
How to Handle Consent Withdrawal
| Step | Action | Notes |
|---|---|---|
| 1. Receive withdrawal | Capture the request | Can be through unsubscribe, email, or dedicated form |
| 2. Record the withdrawal | Document date, time, method | Essential for compliance records |
| 3. Stop processing | Cease marketing sends | Immediate action required |
| 4. Check other lawful bases | Can you retain data under legitimate interest? | Suppression list may be justified |
| 5. Confirm withdrawal | Send confirmation | Optional but best practice |
Consent Withdrawal Best Practices
- Make withdrawal as easy as giving consent: GDPR requires that withdrawing consent is as easy as giving it. If signing up was one click, unsubscribing should also be one click.
- Do not penalise withdrawal: Do not require login, additional information, or extended processes to withdraw consent.
- Distinguish from unsubscribe: A subscriber who unsubscribes has not necessarily withdrawn consent for data processing. Only treat it as consent withdrawal if explicitly stated.
- Document every withdrawal: Maintain records of consent withdrawal requests including the date, method, and action taken.
- Honour withdrawal immediately: Processing must stop as soon as the withdrawal is received. Continued sending after withdrawal is a GDPR violation.
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
AIDA Model for Email
The AIDA model (Attention, Interest, Desire, Action) is a classic copywriting framework used to structure email campaigns that guide subscribers from awareness to conversion.
AMP for Email
AMP for Email is a Google-developed framework that allows email messages to include interactive elements like forms, carousels, accordions, and live content. It turns static emails into dynamic, interactive experiences directly inside the inbox.
Anchoring Effect in Email Marketing
The anchoring effect is a cognitive bias where the first piece of information presented (the anchor) influences subsequent decisions, used in email to frame pricing and value perception.
Announcement Email
An announcement email is a dedicated campaign that communicates a specific update, milestone, or change to subscribers, from product launches and feature releases to company news and events.
Frequently Asked Questions
Unsubscribe stops future marketing emails but does not revoke the underlying consent for data processing. Consent withdrawal revokes the lawful basis for processing the data entirely. After consent withdrawal, you must stop all processing unless you have another lawful basis.
Yes, but only if you have a lawful basis — typically legitimate interest for legal compliance. The suppression record should contain only the minimum data needed to ensure you do not contact the person again.
Without undue delay. In practice, consent withdrawal should be processed immediately — within seconds or minutes, not days. The GDPR does not specify a precise timeline, but best practice is real-time processing.
Not necessarily. You can retain data if you have another lawful basis for processing (such as legitimate interest for suppression or legal obligation for record keeping). You must stop all processing for the purpose for which consent was originally given.
Document the date, time, method of withdrawal, and the specific processing the consent covered. Store this record in your consent management system or ESP. Retain the record for the duration of any applicable retention period.