According to the GDPR, the data subject can withdraw their consent at any time. However, withdrawing the consent applies only to future processing of personal data, not to data that has already been processed. If the obtained consent does not fulfill the requirements of the GDPR, the consent must be re-obtained.
The EU-U.S. Data Privacy Framework: A Transatlantic honeymoon for data flows, but for how long?
The European Commission concluded that the United States ensures adequate protection for personal data transferred from the EU to U.S. companies under the EU-U.S. Data Privacy