The rule.
“It shall be as easy to withdraw as to give consent.”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- The right to withdraw at any time; withdrawal does not affect the lawfulness of processing before it.
- The person is told about the right before giving consent, and withdrawing is as easy as giving consent.
Who it applies to.
Controllers relying on consent — every list, every channel.
Common violations in marketing copy.
To unsubscribe, sign in and go to Settings → Communications
Signing up took one tick; leaving takes a login.
'Are you sure?' → survey → 'pause instead?' → confirm by email
Withdrawal made harder than consent.
Non-compliant vs compliant.
“To stop these emails, contact support with your account number.”
“Unsubscribe in one click: [link]. You can also reply STOP.”
Related rules.
-
GDPR Article 7(1) · European Union
-
GDPR Article 7(2) · European Union
-
GDPR Article 7(4) · European Union
-
GDPR Article 21(2)–(3) · European Union
-
ePrivacy Directive Article 13(2) · European Union
-
GDPR Article 13(1)–(2) · European Union
-
ePrivacy Directive Article 5(3) · European Union
-
NorthPoint’s long-form page.
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 7(3) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/7/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.