Consent renewal after a redesign: when the banner must come back

A site redesigns, the banner gets a fresh look, the vendor list changes, and nobody re-asks for consent, because the redesign was a design project and consent was a legal project, and the two teams never met. The banner looks new and the consent record says the visitor agreed, but the visitor agreed to the old purposes, the old vendors, and the old text. The redesign invalidated the consent, and the site is processing on a record that no longer describes what it does.

Consent is specific. That is not a slogan, it is the requirement. A visitor consents to purposes, not to a website in general, and when the purposes change, the consent has to be renewed. A redesign that adds a vendor, adds a purpose, or changes the banner text has changed what the visitor consented to, and the honest response is to show the banner again and ask again.

What counts as a change that needs renewal

Three changes need renewal, and they cover most redesigns. A new purpose, like adding analytics where there was only a strictly necessary cookie before. A new vendor, like a new chat tool or a new advertising partner, because the visitor consented to the vendors listed, not to vendors in general. And a change to the banner text that changes what the visitor is agreeing to, because the record has to prove what the visitor saw, and the old text version no longer describes the current processing.

A redesign that changes only colours, fonts, and layout does not need renewal, because nothing the visitor agreed to has changed. That distinction is the whole decision. Design changes are free. Purpose, vendor, and text changes are not, and treating them the same way is how a redesign quietly invalidates a year of consent records.

How renewal actually works

Renewal means invalidating the old consent records for the changed purposes and showing the banner again to everyone affected. In practice that means bumping the consent text version, which triggers the banner for returning visitors, and recording the new consent with the new version, timestamp, and purposes. The old records stay, because they prove the processing before the change was lawful. The new records start from the renewal, and the two sets together tell the whole story.

Test it before the redesign ships. Stage the new site, visit it as a returning visitor with an old consent cookie, and see whether the banner appears. If it does not, the version bump is missing, and the redesign will ship with stale consent. If it does, check the record: does it carry the new text version and the new purposes? A banner that appears and records the old version is a banner that lies about what it asked.

The conversation to have before the launch

The conversation is between the design team and the privacy team, and it has to happen before the launch, not after. The design team brings the list of changes. The privacy team marks which ones change purposes, vendors, or text. Those changes get a version bump and a renewal. The rest ship as design. That meeting takes an hour, and it is the difference between a redesign and a compliance incident that nobody notices for a year.

Keep reading: Consent renewal after a policy change: when to re-ask, Consent on a WordPress multisite network.

Frequently asked questions

Does a website redesign require re-asking for consent?

Only if it changes purposes, vendors, or the banner text. A redesign that only changes colours and layout does not need renewal. A redesign that adds a vendor, adds a purpose, or rewrites what visitors agree to does, because the old consent no longer describes the current processing.

How does consent renewal work in practice?

Bump the consent text version, which triggers the banner again for returning visitors, and record the new consent with the new version, timestamp, and purposes. Keep the old records, because they prove processing before the change was lawful.

What happens to old consent records after renewal?

They stay. The old records prove the processing before the redesign was lawful. The new records start from the renewal. Together they tell the whole story, and deleting the old ones would erase the proof.

How do I test renewal before a redesign ships?

Stage the new site, visit as a returning visitor with an old consent cookie, and check whether the banner appears. If it does not, the version bump is missing. If it does, check the record carries the new text version and purposes.