Consent
What happens when consent is withdrawn?
From the moment of withdrawal nothing more is stored, and queued reports to advertising platforms no longer go out. Metrunio then automatically deletes what that browser reported under the withdrawn purpose, usually within a few minutes, and you do not need to create a request. Metrunio also deletes ad contacts from pixel, tag and click redirect that are linked to this browser; all other ad contacts stay.
A visitor withdraws consent. What happens to the data?
- 01Your CMP reports the new state; the SDK adopts it through setConsent and reports it to Metrunio.
- 02From that moment the affected events no longer leave the device. If marketing is withdrawn, no report for this browser that has not yet been sent goes to an advertising platform, and its click IDs are not included in reports from other devices of the same person either.
- 03If everything is withdrawn, the SDK removes its identifier and the session from the browser. If marketing is withdrawn, the collector removes the metrunio_view cookie (the view identifier).
- 04Metrunio deletes what the new state no longer covers, including the touchpoints and conversions derived from it. What rests on another basis is left untouched (table).
- 05The tenant’s log shows when it was deleted and how many records. The identifier is not in it.
| Data class | Everything withdrawn | Only marketing withdrawn |
|---|---|---|
| Events from this browser (page views, purchases …) | deleted | kept; without the view identifier |
| Advertising events the SDK reports itself | deleted | deleted |
| Ad contacts from pixel, viewability tag and click redirect | those linked to this browser: deleted; all others stay | all those linked to this browser: deleted; click and impression IDs are removed from its remaining analytics events |
| Orders your store reports server-side with this browser’s identifier | deleted | kept |
| Orders your store reports without consent (no decision or after a refusal) | not affected, they carry no identifier of this browser | not affected |
| Identifier and session in the browser | removed by the SDK | kept (analytics is still granted) |
| metrunio_view cookie | removed by the collector | removed by the collector |
| Data from other devices of the same person | kept; it rests on their own consent | kept |
Why ad contacts go too: impression, viewability and click come in with a signal from the page where the ad ran (c=1). It does not show that the consent there covers measurement for you through Metrunio and is unaffected by a withdrawal in your shop. As long as there is no proof of that, Metrunio deletes the ad contacts linked to the withdrawing browser; other visitors’ ad contacts stay. This also applies when only marketing is withdrawn: ad contacts attached to a page view through the click or impression ID from the destination URL are deleted too. The page view itself stays as an analytics event with its campaign, but loses the click and impression ID, including their trace in the URL. The result is the same as with analytics-only consent from the start, because without marketing Metrunio never stores these IDs in the first place.
Why server-side orders go too: if your shop reported the order with the browser’s identifier and consent, it rests on that consent. The additional instruction for revenue reconciliation covers only orders reported without consent, that is without a decision or after a refusal. There is no transfer into it after the fact: the order number goes on the suppression list, and if your shop reports the same order again later, for instance without a decision, with the refusal or through a historical import, Metrunio rejects it. The deletion happens at Metrunio, not in your shop system. Measured revenue is then lower than your shop’s by this order, and a later refund shows up as “refund without purchase”. If the person buys again after the withdrawal and your shop reports the refusal with it, the order counts as after any refusal: with an activated additional instruction in revenue, with its order number, without browser, customer or advertising identifiers and without attribution; without the instruction not at all. With the old consent, Metrunio does not accept it.
If the same browser consents again later
- The SDK assigns a new identifier and a new journey begins. The ad contacts from before the withdrawal have been deleted.
- If, after consenting again, the person opens the same destination URL with the old click ID (from their history or a bookmark), it counts as a new visit through the campaign.
- If your shop reports a customer number again after sign-in (identify), the browser belongs to that person again, together with their other devices.
- If the collector could not remove the cookie, for instance because the browser keeps it only in a partitioned store of the ad site, it still no longer links to the old contacts: the link in the data has been deleted.
Note
A withdrawal is not an objection: the browser’s identifier does not go on the suppression list, only the order numbers of deleted purchases and refunds. If the same browser consents again later, it is measured again. Anyone who does not want to be recorded at all files a deletion or objection under “Privacy”. The collector then rejects new events. Likewise, a refusal in the banner is not an objection to revenue reconciliation; you record such an objection under “Privacy” with the order number as the identifier (help article “Additional instruction for revenue reconciliation”).
Legal note
The automatic deletion carries out the instruction in the data processing agreement (section 8, paragraph “Standing instruction on withdrawal”). What rested on the withdrawn consent is deleted, nothing more. Ad contacts would stay after a withdrawal only with proof that the consent on the ad side covers them for you through Metrunio and is not covered by the withdrawal in the shop. If you keep data for another reason, that applies to your own systems.
Last reviewed on 13 Oct 2026
Also asked
- Withdraw consent
- Opt out
- What happens to old data after withdrawal?
- Do I have to request deletion after a withdrawal?
- What happens to ad contacts after a withdrawal?
- Do old clicks reappear after consenting again?
- Are impressions deleted after a withdrawal?
- What happens to server-side orders after a withdrawal?
- Can a deleted order come back through a new import?
- Is a conversion still sent to Google Ads after a withdrawal?
Related articles
- What happens without consent?
Is nothing really stored without consent?
By default, Metrunio stores nothing without matching consent, not even a raw event, and the tracking script sends nothing before a decision. One documented case differs: purchases and refunds your server reports without consent count towards measured revenue for revenue reconciliation, with their order number and without browser, customer or advertising identifiers, and are not attributed. After a refusal this only applies with an activated additional instruction. Without consent on the ad side, the click redirect passes on only the campaign, no click ID.
- How do I handle access, deletion and objection?
A data subject exercises their rights. What do I do?
Privacy requests are handled in the portal under “Privacy”, not by ticket. Every request is recorded and logged in the change log; the data subject is located through a pseudonymous identifier.
- Does a deletion take lasting effect?
Does a deleted person’s data come back on their next visit?
It lasts: a deleted person’s data does not come back on their next visit. Deletion and objection put the identifiers concerned on a suppression list; only a hash of them is stored, which is still pseudonymous personal data and is read for nothing but enforcing the suppression. The collector rejects events from suppressed persons before anything is stored.
- How post-view is measured and where it is not
How does a viewable impression without a click get to a purchase in my shop?
Through a cookie on the measurement address: pixel and viewability tag set it with consent, the SDK in your shop returns it, and the link is made on the server. That works in Chrome and Edge, not in Safari, Firefox or Brave. How large the linkable share is for you is shown as post-view coverage in the portal.