In EU there's GDPR and right to be forgotten. If I forbid company to store my data they're obligated by law to remove it from their servers.
1(b) is 'withdrawal of consent', but note also 1(c), which refers to article 21, which allows subjects to object, and you should (as a controller) have 'compelling legitimate grounds' to continue processing (which is a higher standard than 'legitimate interests', which can be the basis for processing the data in the first place).