The first time your app asks for data (when it is opened, or on requestAuthCode()), DiiL shows a consent sheet with your scopes.
The user can disconnect your app later in Profile → Privacy & security → Connected apps. After that, launch data stops coming, codes aren't issued, and tokens stop working.
If you add scopes, users consent again on their next launch.