Users can change or withdraw consent from persistent mechanism

GDPR Art. 7(3) guarantees the right to withdraw consent at any time, and requires withdrawal to be 'as easy as giving consent.' ePrivacy Art. 5(3) ties this to the ongoing lawfulness of accessing device storage — once consent is withdrawn, tracking must stop. CCPA §1798.135 separately requires a permanent, always-accessible opt-out mechanism. A banner that can only be seen once — dismissed and never reachable again — makes withdrawal functionally impossible, which means any ongoing tracking after the initial consent period continues without a valid ongoing basis.

Add a persistent 'Cookie Preferences' link in the site footer that re-renders the consent banner pre-populated with the current stored state. The link must appear on every page.

// components/Footer.tsx
'use client'
import { useState } from 'react'
import { CookieBanner } from '@/components/CookieBanner'
import { saveConsent } from '@/lib/consent'

export function Footer() {
  const [show, setShow] = useState(false)
  return (
    <footer>
      <button
        onClick={() => setShow(true)}
        className="text-sm text-gray-500 underline hover:text-gray-700"
      >
        Cookie Preferences
      </button>
      {show && (
        <CookieBanner
          showCurrentPreferences
          onSave={(state) => { saveConsent(state); setShow(false) }}
        />
      )}
    </footer>
  )
}

When analytics consent is withdrawn, call window.gtag?.('consent', 'update', { analytics_storage: 'denied' }) immediately to stop GA4 measurement for the current session.