Consent Docs
Open console

Withdraw consent or erase a person

Withdraw one consent for a person who asks you to stop, or erase a person's identifiers from every consent record you hold for them.

How-to3 min readFor privacy, marketing and support teams

Withdraw a consent when a person asks you to stop, for example by phone. Erase a person when they ask you to delete their data. Neither can be undone.

  1. Open Records and click the record.
  2. Choose Withdraw. A record that is already withdrawn has no such button.
  3. Read the warning and choose Withdraw consent.

The console says Consent withdrawn. On the record:

  • Every optional purpose is set to declined. Strictly necessary purposes stay as they were.
  • The status is Withdrawn, with the time.
  • What they did reads Changed by an operator.

Your systems receive the consent.withdrawn webhook, so they can stop the processing. The person would have to consent again to undo it.

Erase a person#

Erasing cannot be undone

Erasing covers every record found for the person, test and live, including any beyond the 100 listed. Check the list before you confirm.

  1. Open Records.
  2. In Find a person or a record, type the person's email address, phone number, user id or device id.
  3. Choose Find.
  4. Check that the records listed are theirs.
  5. Choose Erase identifiers on all of these, under the list.
  6. Read the warning and choose Erase identifiers.

The console says Identifiers erased and returns to the full list. An erased record shows the Identifiers erased badge when you open it.

What erasing does#

For each record found, the product does this in order:

  1. Withdraws consent that is still in force. A record that is Granted, Partial or Pending is withdrawn first, so erasing also ends the consent.
  2. Erases the identifiers. It removes the readable identifier if your project stores one, the subject fingerprint, the IP hash, the browser details, the page address and the data your site attached.
  3. Removes linked identifiers. An email address or phone number that was linked to the record no longer finds it.
  4. Keeps the evidence. The hashes, the times and the decisions stay, and the erasure is sealed into the proof chain.

Your systems then receive up to two webhooks for each record. consent.withdrawn comes first, for each consent that was still in force. subject.erased follows, so your servers can delete their own copy of the person's data.

Erasing here covers consent records only. Your own customer data is yours to delete when subject.erased arrives.

Records from India keep some items for a year

India's DPDP Rules require the data and logs of a processing to be kept for one year. This applies to a record from India, or under the DPDP Act, that was collected, used or withdrawn within the last year. For such a record, the items in step 2 are held back until the year has passed. They are then cleared without any action from you.

Erasing a consent that is still in force withdraws it first. For those records the year starts on the day you erase. The console does not show the held items in the meantime.

↑↓ to move, Enter to open