I wonder, can a pre-ticked checkbox be used to recall/revoke consent, or does revoking/recalling consent need to be a separate, explicit action?
I have made a specific consent function like this: When user first visit website and uses the functions, there is a empty consent checkbox: "Save my details in a cookie so I don't need to enter them everytime".
IF the user gives consent, checks the checkbox, and proceeds, the details are now saved in cookie.
Next time user visit website, the checkbox will now be pre-ticked (as the user previously given consent). If the user wants to revoke or recall the consent, the user can now uncheck the checkbox and proceed, and the cookie will be deleted.
Technically, it works by checking for presence of the said cookie, if cookie is present, box is pre-checked, else box is empty.
I wonder, is this valid consent according to GDPR, and is it permittable to use a pre-ticked checkbox to revoke/recall consent?
I see two legal problems with this: 1: If the user checks the checkbox, and then another user uses the same computer, or the user forgets he consented, the user could believe its an invalid consent as the box is pre-checked. 2: If GDPR law requires the revocation of consent be a separate function and not built-in the consent checkbox, it could be problematic.
Also, I wonder, if I use this scheme and totally locally controlling this function, it will mean that I as a website owner will NOT be able to revoke consent on behalf of the user, only way for the user to revoke his consent is to uncheck the checkbox or delete his cookies.
Is it valid to do this, or MUST I be able to revoke consent on behalf of a user if a user emails and wants to revoke consent, or can I refer user to uncheck that checkbox? Since the details is stored in a cookie, only way for me to revoke consent would be to somehow "ban" that cookie from being activated later on from the server side, requiring me to store personal details of users (either IP-adresses of computers which the cookies should not be respected from and immidiately deleted, or users email adress to "ban" the content of the cookie to be used, and immidiately delete all cookies containing that email adress)
Another thing is that since the function is locally controlled, it means that I don't know or store which users have consented, meaning I do not have any records of consent from users. HOWEVER, since the function is built in such a way that it will only place the cookie if consent is received, it would be sufficent as "consent proof" right?