Most consent banners take one click to accept and a support ticket to undo. That's not a UX nitpick — under India's DPDP Act it's a compliance gap you can point at with a section number.
DPDP §6(4) is short: withdrawing consent has to be at least as easy as giving it. Not "possible." Not "available on request." As easy.
That's a specific, checkable bar — not "have a privacy settings page somewhere." If accepting takes one click and withdrawing takes an email to a DPO, a login you don't remember, or a form buried three menus deep, the two aren't equally easy, and the gap is the violation.
Nobody sits down and decides to make withdrawal hard. It happens by neglect: the consent banner gets a product owner and a deadline; the withdrawal flow gets whatever's left. Accept is the path every visitor takes, so it gets tested, polished, one-click. Withdraw is the path almost nobody takes until they're annoyed enough to go looking for it — so it doesn't get the same attention, and the asymmetry compounds.
The result is structural, not malicious. That doesn't make it compliant.
We didn't get this right on the first pass either. Early in building Consent Tree, withdrawal existed — but it wasn't rendered at the point of notice, so a person had no way to know from the consent screen itself whether something could be withdrawn, or how. Functionally available, practically invisible. That's the same asymmetry the Act is written to stop, just one layer more subtle than "no withdraw button at all."
We fixed it by treating "is this withdrawable" as something the notice has to say, not something a person has to go find out. If we hadn't authored an answer for a given consent, the UI shows it as unset rather than defaulting to "no" — a missing answer isn't the same as a real one, and we didn't want to quietly tell someone they couldn't withdraw something we'd simply never specified.
One email. One link, sent to that address. It shows exactly what was consented to — not a generic settings page, the actual record — and lets you withdraw the optional parts, with a receipt. That's the withdrawal page live on this site right now, not a mockup.
Withdrawing doesn't erase what already happened lawfully under the earlier consent — the Act doesn't ask for that. What it requires is that everything going forward actually stops. That distinction matters more than it sounds: a system that just flips a flag but keeps using old consent as license for new processing hasn't withdrawn anything.