# Deleting cookies after user changes consent **URL:** \ **Category:** Privacy\ **Created:** [September 26, 2022, 7:55pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049 "2022-09-26T19:55:55Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![katanka](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@katanka](https://community.piwik.pro/u/katanka)\ **Post date:** [September 26, 2022, 7:55pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/1 "2022-09-26T19:55:56Z")
Consider this: a user enters my site and approves all cookies. A few moments later he changes his mind and changes his selection. He now approves only the most basic cookies. Will Piwik Pro delete the first set of cookies? When I test this out on my site, the total number of cookies does not drop. Thanks ---
**Author:** ![Tymek](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/tymek/32/268_2.png) [@Tymek](https://community.piwik.pro/u/Tymek)\ **Post date:** [September 27, 2022, 3:16pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/2 "2022-09-27T15:16:41Z")
HI @katanka Cookies are one of the ways of capturing users’ interactions with the site, but users don’t consent to cookies. The consent users grant or deny refers to the use of data you may or may not capture from the user’s visit. When it comes to your question: a change of customer consent should result in a change in the data you capture and process, not necessarily the number of cookies your page produces. Other words: visitors decide if you can utilize data from your cookies. Please visit our Help Center’s [Privacy](https://help.piwik.pro/support/privacy/) section for more information on how to manage users’ privacy. Tymek ---
**Author:** ![katanka](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@katanka](https://community.piwik.pro/u/katanka)\ **Post date:** [September 27, 2022, 6:55pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/3 "2022-09-27T18:55:21Z")
Hi, thanks a lot for your reply! However I’m not entirely convinced. In Belgium we need explicit consent for cookies. Only cookies that are deemed necessary for the visitors (not the siteowner) can be placed without explicit consent. In a recent case, the Belgian DPA issued a €50.000 fine to a Belgian publisher. In the decision, you can read that the DPA inspector just counted the amount of cookies before accepting, after accepting and after changing the consent. See [https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-85-2022.pdf](https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-85-2022.pdf) (articles 154 - 161) Best regards. ---
**Author:** ![Tymek](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/tymek/32/268_2.png) [@Tymek](https://community.piwik.pro/u/Tymek)\ **Post date:** [September 29, 2022, 10:53am UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/4 "2022-09-29T10:53:02Z")
HI @katanka , Thanks for the background. Let me consult to be sure of the answer you need. I’ll get back to you when I have the full picture. Tymek ---
**Author:** ![maciej](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/maciej/32/9_2.png) [@maciej](https://community.piwik.pro/u/maciej)\ **Post date:** [September 29, 2022, 12:28pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/5 "2022-09-29T12:28:00Z")
> [@katanka](#): > > Consider this: a user enters my site and approves all cookies. A few moments later he changes his mind and changes his selection. He now approves only the most basic cookies. > > Will Piwik Pro delete the first set of cookies? When I test this out on my site, the total number of cookies does not drop. If you approved cookies in consent manager and as a result several tags were launched e.g. from Google Ads for the purpose of remarketing, Piwik PRO (nor any other tool as this is technical limitation) will not be able to delete them (especially http only and third-party cookies). You can set a tag that will run and check the consents given (and if withdrawn) delete certain cookies that can be accessed from JavaScript (but you won’t be able to deal with http only and third party cookies this way). We will submit a feature request to our product team to see if this can be a bit simplified for the end users. For analytics you can also use a full cookieless mode (even if consent is given) and this way you won’t have an issue with users who withdrew their consent as no data will be stored on end users device. ---
**Author:** ![rmeekers](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmeekers/32/929_2.png) [@rmeekers](https://community.piwik.pro/u/rmeekers)\ **Post date:** [December 30, 2022, 6:43pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/6 "2022-12-30T18:43:52Z")
> [@maciej](#): > > For analytics you can also use a full cookieless mode (even if consent is given) and this way you won’t have an issue with users who withdrew their consent as no data will be stored on end users device. Local storage is considered equally as cookies. Is what you are saying @maciej that the local storage is cleared once the consent changed to deny? Can you give us an update anyhow on this topic? I need to make a decision whether I will write a cleanup script or wait until you guys came up with a feature to simplify this. ---
**Author:** ![maciej](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/maciej/32/9_2.png) [@maciej](https://community.piwik.pro/u/maciej)\ **Post date:** [January 2, 2023, 12:06pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/7 "2023-01-02T12:06:09Z")
If you use the cookieless mode turned on, then neither cookies nor local storage is used for analytics unless visitor gives consent for it. If you have consent banner turned on, we will use necessary cookies to store consent decision as otherwise you would see the banner every time you refresh the page. We will not set the visitor cookies nor local storage unless the visitor gives the consent for it. To illustrate, please see the screenshots with the two settings I am referring to: **1. Analytics only with visitor cookies turned off** - no cookies/local storage used: ![Screenshot 2023-01-02 at 13.00.31](https://europe1.discourse-cdn.com/flex005/uploads/piwikpro/original/2X/1/14be2860159b326af1282d65c748f3fd19fcd4c5.png) **2. Consent manager turned on, but cookies turned off** - cookies/local storage used only to store the consent decision. Cookies will be used for visitor tracking only after consent is given by the visitor. ![Screenshot 2023-01-02 at 13.00.41](https://europe1.discourse-cdn.com/flex005/uploads/piwikpro/original/2X/2/2c0d0bccc4bbcb100f8e42d33796d19bdf95a9b5.png) ---
**Author:** ![rmeekers](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmeekers/32/929_2.png) [@rmeekers](https://community.piwik.pro/u/rmeekers)\ **Post date:** [January 2, 2023, 9:05pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/8 "2023-01-02T21:05:24Z")
I am aware of that. But the question is: what happens after step 3 with cookies/local storage: 1. Visitor gives consent 2. Cookies and/or local storage is in use 3. Visitor reviews consent and chooses to deny all ---
**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\ **Post date:** [January 4, 2023, 9:44am UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/9 "2023-01-04T09:44:29Z")
Hi. We store “reject state”. It’s done so to block displaying the consent popup. ---
**Author:** ![rmeekers](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmeekers/32/929_2.png) [@rmeekers](https://community.piwik.pro/u/rmeekers)\ **Post date:** [January 4, 2023, 9:47am UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/10 "2023-01-04T09:47:28Z")
Yes I know, but why don’t you remove unnecessary cookies / local storage afterwards? Is there an API endpoint to do so? Or do we need to do that manually? ---
**Author:** ![Admin](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Admin](https://community.piwik.pro/u/Admin)\ **Post date:** [January 4, 2023, 9:55am UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/11 "2023-01-04T09:55:37Z")
As for the analytics, you can use this method: [API — Piwik PRO Analytics Suite 16.33 documentation](https://developers.piwik.pro/en/latest/data_collection/web/javascript_tracking_client/api.html#deleteCookies) But I agree that it could be improved to make it easier to implement. Adding it to our backlog. ---
**Author:** ![DMuller](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/dmuller/32/1918_2.png) [@DMuller](https://community.piwik.pro/u/DMuller)\ **Post date:** [June 14, 2023, 10:16pm UTC](https://community.piwik.pro/t/deleting-cookies-after-user-changes-consent/1049/12 "2023-06-14T22:16:09Z")
Are there any upates on simplifiying the deletion of cookies if the consent settings were changed by the visitor? Or is there a guide available on how to implement a cleanup script to delete cookies the visitor changed consent for?