Designing consent withdrawal and downstream deletion UI in Figma: cascades, confirmations, and audit trails

Quick answer

Consent withdrawal UI lets users revoke permission clearly, see what will stop or be deleted, and confirm without trapping them in dark patterns—while your backend cascades changes to ads, analytics, and processors. Design a preference center with scoped toggles (not one “off” button); a withdrawal preview listing downstream systems affected; and a confirmation + receipt stored in the consent ledger. Start from the Figma guides hub and pair with consent admin, cookie consent, privacy settings, DSAR portal, and Dev Mode handoff.

---

Who this is for

• Product designers building preference centers, account privacy pages, or in-app “stop sharing” flows.
• Privacy engineers mapping consent scopes to tags, ad partners, and data warehouses.
• Compliance teams proving withdrawal was honored within regulatory timelines (GDPR Art. 7(3), CPRA opt-out).

---

Consent withdrawal hub (internal overview)

ConsentWithdrawalHub — Acme App · 1.2M active consents · 18 scopes · 42 downstream integrations
├── Header: Withdrawals last 24h 3,412 · Failed cascades 7 · Avg propagation 4.2 min
├── Actions: [ Simulate withdrawal ] [ Fix failed cascade ] [ Export audit ] [ Edit scope map ]
├── Tabs: Scopes · Dependencies · Withdrawal queue · Receipts · Grace periods · Incidents
├── Alert: Scope marketing_ads · 2 partners still firing pixels after revoke · INC-CON-881
├── Filters: Region · Scope · Channel · Status (pending/applied/failed)
└── Link: [Consent admin](/designing-consent-records-and-preference-management-admin-ui-in-figma/) · [Cookie banner](/designing-cookie-consent-and-tracking-preference-ui-in-figma/) · ROPA · DSAR

Section	Purpose
Scopes	Legal purposes: analytics, ads, personalization, email
Dependencies	Which vendors and features turn off per scope
Withdrawal queue	Async jobs propagating to CDP, ad networks, email
Receipts	User-facing confirmation + internal audit ID
Grace periods	Optional delay before hard deletion (where lawful)
Incidents	Partners that failed to honor revoke

Verdict: Withdrawal fails when the UI says “saved” but ad tags still fire—show propagation status, not instant fiction.

---

Preference center: scoped withdrawal (customer-facing)

PreferenceCenter — Privacy · Your choices
├── Essential (always on): Login, security, billing · Cannot withdraw · [Why essential?]
├── Analytics · Currently ON · Last changed Aug 2
│   ├── [ Withdraw consent ] · Stops product analytics and A/B tests · Keeps aggregated SLA metrics
│   └── Partners affected: Amplitude, internal warehouse · Propagation ~5 min
├── Marketing email · Currently ON
│   ├── [ Unsubscribe ] · Separate from ads · CAN-SPAM one-click
│   └── Does not delete purchase history
├── Personalized ads · Currently OFF · CCPA "Do Not Sell/Share" honored
├── Personalization · Currently ON
│   ├── [ Withdraw ] · Disables recommendations · Generic home feed
│   └── Linked: [AI personalization](/designing-ai-training-opt-out-and-model-data-usage-transparency-ui-in-figma/) · tenant-only if training off
├── Download: [ Export consent history ] · [ DSAR request ](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/)
└── Footer: Withdrawing consent is as easy as giving it · No account penalty · See [policy changelog](/designing-privacy-notice-version-management-and-policy-changelog-ui-in-figma/)

Rule	Implementation
Granular scopes	No single toggle that hides marketing inside “analytics”
Equal prominence	Withdraw button same weight as accept
No dark patterns	No extra login steps or timed nag screens
Separate legal bases	Email unsubscribe ≠ ad consent ≠ analytics
Effective timing	Show “applied” vs “pending” honestly

---

Withdrawal preview and confirmation

WithdrawPreview — You are withdrawing: Analytics
├── What stops immediately:
│   ├── Event tracking in app and web · Session replay disabled
│   ├── A/B experiment enrollment · You see default experience
│   └── Third-party analytics SDKs unloaded on next page load
├── What we keep (legal basis):
│   ├── Billing and tax records · Contract · 7 years
│   ├── Security logs · Legitimate interest · 90 days
│   └── Aggregated metrics with no user ID · Anonymized
├── Downstream deletion (within 30 days):
│   ├── Amplitude user profile · Delete request queued
│   └── Marketing CDP segment · Remove from audiences
├── Grace period: None for analytics · Marketing ads uses 48h ad network sync
├── Re-consent: You can turn analytics back on anytime · New notice v2.1 shown
└── [ Confirm withdrawal ] · [ Cancel ] · Requires checkbox: "I understand recommendations may reset"

Preview dependencies from the scope map—users should not discover surprises in support tickets.

---

Withdrawal receipt and audit trail

WithdrawReceipt — Confirmation #CW-2026-88421
├── Scopes withdrawn: analytics, personalization
├── Timestamp: Aug 10 2026 03:14 UTC · Method: preference center · Notice v2.1
├── Propagation status:
│   ├── Acme app: Applied ✓
│   ├── Amplitude: Pending · ETA 15 min
│   └── Google Ads: Applied ✓
├── Your rights: [ Download receipt PDF ] · [ Open DSAR ](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · Contact DPO
└── Stored in [consent ledger](/designing-consent-records-and-preference-management-admin-ui-in-figma/) · Immutable event ID

Failed cascades trigger user notification only if material (e.g., ads still personalized after 72h)—otherwise fix silently and log.

---

Admin: scope dependency map

ScopeMapAdmin — analytics · Edit dependencies
├── Legal basis: Consent · Notice section 4.2 · Regions: EU, UK, BR
├── User-facing label: "Product analytics"
├── On withdraw:
│   ├── Disable SDK: amplitude.js, experiment.js
│   ├── CDP: Remove user_id from segment analytics_users
│   ├── Warehouse: Flag row for deletion job DAILY-ANON-02
│   └── Block: New experiment enrollment API returns 403
├── Exceptions: Aggregated uptime metrics · No user_id · Keeps running
├── SLA: 95% propagations < 15 min · Alert channel #privacy-ops
├── Linked ROPA: PA-104 Product analytics · PA-112 A/B testing
└── [ Test withdrawal for user @qa-privacy ] · [ View failed jobs ]

Engineering and Legal share this map—UI copy must match actual backend behavior.

---

Comparison: withdrawal vs deletion vs opt-out

Action	User expectation	Typical backend
Withdraw consent	Stop processing for that purpose	Disable tags, remove from audiences
Delete account	Erase personal data broadly	Cascade deletes + legal holds
CCPA opt-out of sale/share	No cross-context ads	Identity sync to ad partners
Unsubscribe email	No marketing messages	Suppression list only

Use distinct flows—merging them creates compliance and support debt.

---

Handoff checklist (Dev Mode)

• ConsentScope — scope_id, legal_basis, notice_version, regions[], user_label, description.
• WithdrawalRequest — user_id, scopes[], requested_at, confirmation_token, client_surface.
• CascadeJob — job_id, scope_id, target_system, status, started_at, completed_at, error_code.
• WithdrawReceipt — receipt_id, withdrawal_request_id, propagation_summary[], pdf_url.
• ScopeDependency — scope_id, systems[], sdk_ids[], deletion_job_id, exceptions[].
• GracePeriodPolicy — scope_id, duration_hours, lawful_basis_note.
• Accessibility — confirm dialogs trap focus; status not color-only; receipts available without JavaScript where possible.

---

Common mistakes

Mistake	Why it hurts	Fix
”Saved” before cascade completes	False compliance claim	Show pending/applied per system
One mega toggle	Invalid granular consent	Split scopes with clear labels
Withdraw harder than accept	GDPR Art. 7(3) violation	Same number of steps
No preview of consequences	Support load, distrust	Dependency preview screen
Confusing unsubscribe with ad consent	Regulatory mismatch	Separate flows and copy
Ignoring re-consent notice	Stale legal basis	Show notice version on re-enable
No receipt	DSAR disputes	Email + downloadable PDF
Grace period without disclosure	Deceptive delay	Explain lawful retention windows

---

Recommended workflow

1. Inventory scopes and dependencies with Legal and data engineering.
2. Design preference center with equal-weight withdraw actions.
3. Add preview screen listing stops, keeps, and deletion timeline.
4. Ship confirmation receipt wired to consent ledger.
5. Build admin scope map for QA simulations and incident response.
6. Monitor cascade SLAs; alert on partner failures like ad pixels post-revoke.
7. Cross-link cookie banner so web and account settings stay synchronized.

---

FAQ

Same as cookie consent?

Cookie banner is the first collection moment; preference center handles ongoing withdrawal and must sync the same scopes.

Link to DSAR?

Withdrawal receipt IDs should appear in DSAR exports; full erasure may require a separate deletion request.

Account deletion?

Broader than consent withdrawal—design a dedicated flow with legal holds and offboarding parallels for B2B.

Re-enabling consent?

Show current notice version; do not pre-check boxes.

B2B admin locks?

Enterprise may disable analytics org-wide—reflect read-only state and hide misleading toggles.

---

Next steps

• Design consent records and preference management admin UI in Figma — ledger for every withdrawal event
• Design cookie consent and tracking preference UI in Figma — align first-party and web scopes
• Design privacy settings and data management UI in Figma — host preference center entry points
• Design data subject access request and GDPR portal UI in Figma — erasure beyond scope withdrawal
• Design privacy notice version management and policy changelog UI in Figma — re-consent on policy updates