Why withdrawal and legal texts must be reachable
Consent must be as easy to withdraw at any time as it was to give. The imprint and the privacy policy must stay reachable, even while the banner is open.
How it works
Under Article 7(3) of the GDPR, anyone can withdraw their consent at any time, and withdrawing must be as easy as giving it. If someone agreed with one click in the banner, they need an equally simple way back. The usual solution is a “Cookie settings” link in the footer of every page or a small icon at the edge of the screen that opens the banner again.
Then there are the legal texts. In Germany, the imprint (the legal notice required by § 5 DDG, formerly § 5 TMG) must be easy to recognise, directly reachable and permanently available. The privacy policy must be easily accessible under Article 12 GDPR. Anyone asked to decide whether to agree must first be able to read who runs the website and what happens to their data.
After the choice in the banner, bytereport looks on the checked pages for a link or button that reopens the settings. It also checks whether the banner covers the page: if it sits as a window over almost the whole screen, it must link the imprint and the privacy policy itself.
What matters
- A way back on every page. A footer link such as “Cookie settings” or “Change consent”, or the consent tool's icon. A note in the privacy policy telling people to delete cookies in their browser is not as easy as one click.
- Withdrawal takes effect from then on. Afterwards, the services concerned no longer load. Many consent tools also delete their cookies, as far as they can technically reach them.
- Legal texts despite the banner. If the banner covers the page, links to the imprint and the privacy policy belong in the banner itself. Ideally, neither page shows the banner as a barrier.
- Readable and usable. The links are recognisable as links and work with mouse, touch and keyboard.
How to set it up
Most consent tools offer a floating icon you can switch on, or a call you put behind your own footer link; with Cookiebot, for example, it is Cookiebot.renew(). Your tool's documentation names the right call. You enter the links to the imprint and the privacy policy in the banner's settings; many tools have dedicated fields for them. Whoever looks after the website does this in the consent tool and in the CMS footer template.
This is not legal advice; your data protection officer or a lawyer decides the individual case.