Yes, they can. Article 7.3 states that a data subject has the right to withdraw their consent at any time. It should be as easy to withdraw consent as it is to give it. If data subjects withdraw consent, the applicable information must be removed and can no longer be processed by the data controller.