Yes, a customer can withdraw a testimonial after publication, and the business should stop displaying the personal data covered by that withdrawal. ReviewMix gives each submitter a private self-service link so they can manage their testimonial without creating an account or waiting for the business to respond.
Can a customer withdraw consent for a published testimonial?
A customer can withdraw consent for a published testimonial at any time under the GDPR. A testimonial connected to an identifiable person, especially one containing a name or photograph, is personal data.
Publication does not make consent permanent. If consent is the legal basis for using the testimonial, withdrawing that consent means the business must stop the affected use unless another valid legal basis applies.
The practical response should include checking every place where the testimonial appears. That may cover website widgets, campaign materials, social posts and paid advertising, depending on the permissions originally granted.
A withdrawal does not mean silently rewriting the historical consent record. The business needs to act on the customer's current choice while retaining suitable evidence of what was agreed, when it was agreed and when the choice changed.
Printed materials and active advertising can create a direct cost. Before ordering a large print run or committing advertising spend, check that the relevant consent is current and that the customer has specifically agreed to that use.
Why does consent per field matter for withdrawal?
Consent per field lets the customer change one permission without cancelling every permitted use. ReviewMix asks separately whether the business may show the customer's name, photo and company, and whether the testimonial may be used in paid advertising.
Separate choices make the scope clear for both sides. A single approval covering every purpose can leave the business unsure whether removing one element requires removing the entire testimonial.
The fields that deserve separate decisions include:
- Showing the customer's name
- Showing the customer's photograph
- Showing the customer's company
- Using the testimonial in paid advertising
Granular consent also makes a partial withdrawal practical. When a customer withdraws the photo, the company or the advertising permission, the business can remove that element while preserving content that still has valid permission.
The same principle applies when collecting the testimonial. Collecting testimonials with consent gives the customer meaningful choices before publication, rather than presenting one broad condition for unrelated uses.
In ReviewMix, the name permission is the one exception to partial withdrawal. A testimonial is only shown with the customer's name, so withdrawing the name removes the whole testimonial from every widget, while the photo, the company and role, and the paid-advertising permission can each be withdrawn on their own.
What does a partial withdrawal look like in practice?
A partial withdrawal removes only the personal data or use for which permission has ended. The remaining testimonial may stay published when its separate consent remains valid and the text does not identify the customer through other details.
Example: Ana submits a four-sentence testimonial and separately agrees to show her name, photograph and company. Two months after approval, she withdraws permission for the photograph but keeps her other choices unchanged.
ReviewMix records the new choice, removes Ana's photograph from every connected widget within 60 seconds and continues displaying her words, name and company. The original permission is not overwritten, so the business can see the sequence of consent and withdrawal rather than an unexplained current value.
A partial change still needs a careful content check. If the written testimonial itself reveals information that the customer no longer wants published, removing the photograph alone may not address the request.
How does the customer withdraw without contacting the business?
The ReviewMix self-service portal lets the customer view, edit, withdraw or export a testimonial through a private link. The customer needs no account, password or login.
The private link avoids making the customer find the correct employee or explain the request through a general contact form. It also gives the submitter a direct view of the testimonial and its permissions.
When the customer withdraws through the portal, ReviewMix sends the change to every widget within 60 seconds. That rapid propagation matters when the same approved testimonial appears across several pages or websites.
Businesses should still have a process for requests received by email, telephone or another channel. The self-service route is useful, but it should not become a reason to disregard a clear request submitted elsewhere.
Customers can find the available controls in data rights for testimonial submitters.
What consent record should the business keep?
The business should keep evidence of each separate consent, including the time and the exact wording shown to the customer. ReviewMix stores those choices in an append-only record, which means earlier entries are preserved rather than edited in place.
That record should make the sequence understandable:
- What the customer agreed to
- Which personal data and uses were covered
- What wording accompanied each choice
- When each choice was recorded
- What the customer later withdrew
- When the withdrawal was recorded
A data protection officer may ask the business to demonstrate both the original permission and its later handling. A current yes or no field cannot show that history on its own.
The record also helps the business explain why one element disappeared while another remained. For a partial withdrawal, the evidence should connect the customer's separate choices to the resulting publication state.
Good records do not replace prompt action. The useful outcome is a clear chain of consent decisions combined with removal of the affected material wherever the business controls its publication.
How long a business may keep the testimonial and the consent record afterwards is covered in how long to keep customer testimonials under GDPR.
