What should consent management support regarding withdrawal and privacy laws?

• A. Consent withdrawal and alignment with privacy laws.
• B. Consent never changes.
• C. Consent is only for marketing emails.
• D. Consent is optional and not tracked.

Answer: (A)

Consent management must support withdrawal of consent and stay aligned with privacy laws. People must be able to withdraw their consent easily, at any time, and the system should record the withdrawal with a timestamp, the scope of what is affected, and the data processing activities involved. When consent is withdrawn, processing based on that consent should stop promptly, and any use of data tied to that consent should halt unless there is another lawful basis to continue. An auditable record is essential so you can demonstrate compliance during audits and respond to data subject requests. The withdrawal needs to propagate across all connected systems and processors—marketing tools, analytics, and data stores—so the preference is honored everywhere. It also must respect data retention rules and other privacy requirements, ensuring that honoring a withdrawal doesn’t conflict with any legal obligations. Remember, consent is not only about marketing emails; it can be the basis for various data processing activities, so the system should manage withdrawals across all relevant processing, not just communications.