What happens to personal data when consent is withdrawn on a social media platform? This question is not only technically complex but also central to ongoing tension in the enforcement of European data protection law. This tension stems from the gap between the formal recognition of user autonomy and the practical realities of how data is processed in commercial environments. This article will argue that once consent is withdrawn, data controllers (social media platforms) must not attempt to continue processing personal data under an alternative legal basis, as doing so undermines both the letter and the spirit of the General Data Protection Regulation (GDPR).