Privacy finding
Cookies and requests that came with consent stay after consent is withdrawn
Privacy Error Severity: High
Part of the audit The banner promises a choice the site does not honour. Finding id: privacy.withdrawalKeepsCookies.
What it costs you
The visitor took the consent back and the identifier set with it is still in the browser.
What to do
When consent is withdrawn, delete the cookies and stored values that were set with it and stop the tags that read them.
What it checks
- Withdrawing consent leaves cookies in place
How to fix it
Make the tags stop after withdrawal
- Find what loads [host].
- Check that it reads the consent state on every page load and not only once. A tag that was allowed on the first page must be held back after the choice changed.
How to check: Accept, withdraw, reload: the network panel shows no request to [host]. Then run the scripted visit again.
Delete what was set with consent
- Look in the consent tool for a setting that removes cookies of a category when its consent is withdrawn. We do not name it because it differs per tool.
- Where the tool cannot delete an item (a cookie of another domain, a value in local storage), delete it in your own code on the withdrawal event.
How to check: Accept, withdraw, reload: the browser's storage panel no longer shows [name]. Then run the scripted visit again.
A real case
France's data protection authority found that when visitors to shein.com clicked Refuse all, or withdrew their consent, new cookies were still placed and cookies already there were still read. In September 2025 it fined the company 150 million euros.
How to verify by hand
The consent platform's documentation on what it does when consent is withdrawn.
What this relies on
The withdrawal control updates the stored choice and nothing else.