What does withdrawing consent look like in practice?