Under the GDPR, it should be as easy to withdraw consent as it is to give. It is a change with regards to the Directive, which did not specifically address the idea of withdrawing consent. Now data subjects can withdraw their consent at any time, without being required to explain their decision. Note however, that this right cannot be applied to data already processed, it can only refer to future processing. Children are a special category which we discussed in our article ‘What happens with consent when working with children?’ We will also note the fact that any consent obtained under the Directive that does not satisfy the requirements of the GDPR has to be re-obtained.