Users re-prompted when cookie purposes or third parties change

GDPR Art. 7(3) states that a data subject has the right to withdraw consent at any time, and Recital 32 clarifies that consent must be granular and specific to each purpose. When new tracking purposes or third parties are added without re-prompting users, the original consent — even if validly obtained — no longer covers the new processing. ePrivacy Art. 5(3) ties the scope of consent to the specific purposes declared at the time of collection. A user who consented to analytics-only in 2024 has not consented to the marketing pixel added in 2025, and treating their stored preference as blanket consent for all future additions is unlawful.

Store a consent version alongside the user's decision and compare it to a CONSENT_VERSION constant on every page load. Bump the constant whenever you add a new third-party service or cookie category.

// src/lib/consent.ts
const CONSENT_VERSION = '1.1' // was '1.0' — bumped when Segment was added

export function needsConsent(): boolean {
  const raw = localStorage.getItem('cookie_consent')
  if (!raw) return true
  const stored = JSON.parse(raw)
  return !stored.version || stored.version !== CONSENT_VERSION
}

Add bumping CONSENT_VERSION to your team's checklist for adding any new analytics tool, ad pixel, or embedded third-party service. The banner will automatically re-appear for returning users whose stored version predates the change.