Analytics opt-out mechanism exists
Why it matters
GDPR Art. 7(3) and CCPA §1798.120 both grant users the right to withdraw consent as easily as they granted it. A consent banner that can only accept — with no mechanism to subsequently revoke — fails this requirement. In practice this means users who later change their mind have no path to opt out short of clearing their browser storage, which most won't do. DPA enforcement has specifically targeted "roach motel" consent implementations where acceptance is one click but withdrawal requires contacting support.
Severity rationale
Medium because a missing opt-out mechanism is a GDPR Art. 7(3) violation that prevents users from exercising a granted right, but does not directly cause data capture beyond what was already consented.
Remediation
Add a "Cookie preferences" button in your footer that clears the consent flag and re-shows the banner on reload:
// components/Footer.tsx
<button
onClick={() => {
localStorage.removeItem('analytics_consent')
window.location.reload()
}}
>
Cookie preferences
</button>
If you use a CMP (CookieYes, OneTrust), the CMP widget handles this automatically — ensure the re-open trigger is actually linked from the footer. For GA4, also set the GA opt-out cookie on decline: window['ga-disable-G-XXXXXXXXXX'] = true.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Analytics & Tracking Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7(3) — Right to withdraw consent
- ccpa · §1798.120 — Right to opt-out of sale of personal information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from marketing-analytics·automated