Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I get consent from user for some operation. While consenting user can check "remember consent" option and this is handled as below:
But problem is at step 2. If user cancel HTTP request that give us consent after the consent is saved in db, then consent isn't deleted from db. So at another request this consent this consent will be used.
Is it legal behavior?
The GDPR does not prescribe how exactly consent must be managed, as long as consent was obtained in line with the GDPR's principles. Similarly, the EDPB does not provide concrete recommendations in its guidelines on consent, mainly noting that
Controllers are free to develop methods to comply with this provision in a way that is fitting in their daily operations.
I would not be too concerned with edge cases like failing HTTP requests, at least not any more than for other HTTP endpoints. If the user indicated consent, and you act on that indication of consent in good faith, that's probably fine.
However, remember that you must provide a equally easy way for the user to revoke consent later. If the user changes their mind, they can use the mechanism that you offer to inspect their consent status, and revoke it if they want. But again, how to do that is largely up to you.
