Most stores that have added a consent banner think the job is done once the banner shows up and shoppers click something on it. That is only half the requirement. The other half, which gets skipped far more often, is what happens when a shopper changes their mind.
The part of consent everyone forgets
Consent under the DPDP Act is not a one-way door. A shopper who agreed to data collection last month can decide today that they no longer want to. The law expects withdrawal of that consent to be available, and specifically expects it to be about as easy as giving the consent was in the first place, and reachable from roughly the same place.
This is a simple idea with an uncomfortable implication for a lot of existing setups. If a store's consent banner takes one click to accept, and the only way to withdraw is to email support, wait for a reply, and hope someone acts on it, that is not symmetrical. The shopper could say yes in a second but needs a multi-day round trip to say no. That gap is exactly what the symmetry expectation is meant to close.
Why "buried somewhere" does not count
A withdrawal mechanism that technically exists but lives three menus deep in an account settings page, or requires finding a privacy email address nobody has linked anywhere obvious, is not meaningfully the same as the banner that greeted the shopper on their first visit. The test is not whether a withdrawal path exists on paper. It is whether an ordinary shopper, with no legal knowledge and limited patience, could actually find and use it in under a minute, the same way they could give consent in under a minute.
Practically, this means the withdrawal option needs to live somewhere a shopper would naturally look again: the same banner mechanism if it reappears, a clearly labelled link in the footer, or a setting inside their account that is not hidden behind unrelated menus. It does not need to be elaborate. It needs to be as obvious as the original prompt.
What changes once consent is withdrawn
Withdrawing consent is not retroactive. It does not undo processing that already happened under valid consent. What it does is stop future processing for the purposes the shopper withdrew consent for, going forward. A store's job is to record that the withdrawal happened, with a date, and to make sure its own practices going forward reflect it, rather than continuing to run the same marketing flows as if nothing changed.
This is also why a consent record needs to be more than a single yes or no stored somewhere vague. It needs a timestamp for when consent was given and an equally clear timestamp for when, if ever, it was withdrawn, because that pair of dates is what tells anyone looking, the merchant, an auditor, or eventually the Data Protection Board, what the shopper actually agreed to and for how long.
Why this is worth getting right the first time
A consent banner built without a visible, equally easy withdrawal path is not half compliant, it is a notice problem waiting to surface the first time a shopper actually tries to exercise the right and cannot find how. Building the symmetry in from the start, rather than retrofitting it after someone complains, is the cheaper version of this fix by a wide margin.
Consent Jet's consent banner is built with this symmetry in mind: every shopper answer is logged as tamper-evident proof, which means both the yes and any later change of mind are recorded with the same discipline, not just the first click.