Users can withdraw consent from settings; withdrawal stops processing

GDPR Art. 7(3) is explicit: withdrawal of consent must be as easy as giving it, and processing must stop immediately upon withdrawal. A settings toggle that logs a withdrawal but continues sending events to analytics or ad networks is a phantom control — it creates the appearance of compliance while the violation continues. CCPA §1798.120 similarly requires that opt-out of data sale take effect within 15 business days. A backend that ignores the consent flag converts every post-withdrawal data collection event into a separate unlawful processing incident.

Check the most recent consent record in every data collection code path — do not cache the consent state in memory across requests. Add a middleware guard in src/middleware.ts or in the relevant route handler:

async function shouldCollectAnalytics(userId: string): Promise<boolean> {
  const latest = await db.userConsentAudit.findFirst({
    where: { userId, processingType: 'analytics' },
    orderBy: { consentedAt: 'desc' }
  });
  return latest?.consentGiven ?? false;
}

// In your analytics event handler
app.post('/api/events', async (req, res) => {
  if (!(await shouldCollectAnalytics(req.user.id))) {
    return res.status(204).end(); // silently discard
  }
  await trackEvent(req.body);
  res.status(200).end();
});

Flush any client-side analytics queue immediately on withdrawal — don't wait for the next page load.