Users can withdraw consent as easily as they gave it

GDPR Art. 7(3) states explicitly that withdrawal of consent must be as easy as giving it. If a user accepted analytics cookies in one click from a banner, withdrawal cannot require navigating to three nested settings menus, sending an email, or hunting for a link that only appears during the initial visit. This symmetry requirement is not ambiguous — it is black-letter GDPR text. Applications that bury consent management after the initial banner interaction effectively make consent irrevocable in practice, which invalidates the consent entirely under Art. 4(11) (consent must be freely withdrawable).

Add a persistent 'Cookie Preferences' button to every page footer that reopens the consent banner. Withdrawal must stop non-essential scripts on subsequent navigation.

// Footer component
function handleReopenConsent() {
  localStorage.removeItem('gdpr_consent_v1')
  window.dispatchEvent(new CustomEvent('reopen-consent-banner'))
}

<button onClick={handleReopenConsent} className="text-sm underline">
  Cookie Preferences
</button>

// In ConsentBanner.tsx — listen for the reopen event
useEffect(() => {
  const handler = () => setVisible(true)
  window.addEventListener('reopen-consent-banner', handler)
  return () => window.removeEventListener('reopen-consent-banner', handler)
}, [])

Verify that withdrawing consent actually stops the associated scripts — clear the stored consent, re-check the gate logic, and confirm analytics events are no longer fired on the next page navigation after withdrawal.