Consent & Privacy Service  ·  View 04 of 22  ·  People and journeys

Journey — Withdraw a Consent

The toggle takes 200 milliseconds. The consequence takes up to fifteen minutes, and the gap between them is the whole user experience.

Editable source SVG draw.io All views
Everyday user mobile, 40 seconds of patience Goal — Stop the thing I just refused Trigger — An advert that felt far too accurate Done when — It stops, and I can see for myself that it stopped 1 · Notice outside the app 2 · Refuse 3 · Doubt ◆ moment of truth 4 · Verify 5 · Live with it What they do Sees the advert Opens preferences Toggles it off Waits Checks it took Reopens the app What the platform does Ledger entry written Receipt returned Stream fans out Decision returns DENY Processors instructed How it feels Reassured Neutral Suspicious Where it hurts Nothing visibly changes No sign vendors were told What answers it Withdrawal as easy as grant Published 15 min ceiling Receipt names version + time Per-recipient status shown Journey — Withdraw a Consent The trough is the gap between the toggle and any visible consequence. The design answer is a receipt and a published ceiling, not a faster fan-out. v 1.0 · owner Security & Identity Architecture

The trough, and the answer

  • The low point is Doubt: the subject has acted and nothing visible has changed. No achievable propagation speed removes it, because the subject cannot see propagation.
  • The design answer is honesty rather than speed — a receipt naming the ledger version and the timestamp, a published fifteen-minute ceiling, and a per-recipient status the subject can read.
  • Withdrawal is held to parity with grant: no extra steps, no extra authentication. A withdrawal that is harder than the grant was never freely given.

Assumptions

  • Withdrawal visible at every first-party enforcement point within 5 s at p95, 60 s at p99, hard ceiling 15 minutes.
  • Programmatic recipients within 24 h; manual-mechanism recipients within a 7-day default contractual window.

Risks

  • A receipt that names a version the subject cannot interpret is theatre. The surface must say what it means in plain language, which is a content problem the architecture cannot solve.
  • Exceeding the ceiling is unlawful processing, not a slow dashboard. It is wired as a paging alarm in view 17 for that reason.
◀  Actors and Their Core Journeys All views Journey — Delete My Account  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1004-journey-withdraw-a-consent