privacy gdpr
Do the GDPR and Cookie-Law regulations apply to localStorage?
<p>We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is not accessible by third-parties.</p>

<p>Should we show the banner asking for permission to use cookies (the legislation requires to use the name cookie also for similar technologies) anyway? </p>

<p>The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the <a href="https://en.wikipedia.org/wiki/Privacy_and_Electronic_Communications_Directive_2002" rel="noreferrer">Privacy and Electronic Communications Directive 2002/58/EC</a> and is amended by <a href="https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0011:0036:En:PDF" rel="noreferrer">Directive 2009/136/EC</a>, where the relevant text of Article 5(3) is found:</p>

<blockquote>
  <ol start="3">
  <li>Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal
  equipment of a subscriber or user is only allowed on condition that
  the subscriber or user concerned has given his or her consent, having
  been provided with clear and comprehensive information, in accordance
  with Directive 95/46/EC, inter alia, about the purposes of the
  processing. This shall not prevent any technical storage or access for
  the sole purpose of carrying out the transmission of a communication
  over an electronic communications network, or as strictly necessary in
  order for the provider of an information society service explicitly
  requested by the subscriber or user to provide the service.</li>
  </ol>
</blockquote>

<p>This is a <a href="https://en.wikipedia.org/wiki/Directive_(European_Union)" rel="noreferrer">Directive</a>, which is not directly binding, member states must implement it in their own law. But there will not be large differences to the text above.</p>

<p>The <a href="https://ico.org.uk/media/for-organisations/documents/1545/cookies_guidance.pdf" rel="noreferrer">guidance from the UK's ICO</a> includes useful examples in particular about the exceptions to obtain consent.</p>

<blockquote>
  <p>There is an exception to the requirement to provide information about cookies and obtain consent where the use of the cookie is:</p>
  
  <p>(a) for the sole purpose of carrying out the transmission of a communication
  over an electronic communications network; or</p>
  
  <p>(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. </p>
</blockquote>

<p>The best example is a shopping cart:</p>

<blockquote>
  <p>This exception is likely to apply, for example, to a cookie used to ensure that when a user of a site has chosen the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, the site ‘remembers’ what they chose on a previous page. This cookie is strictly necessary to provide the service the user requests (taking the purchase they want to make to the checkout) and so the exception would apply and no consent would be required. </p>
</blockquote>

<p>And there is a negative example which is unlikely to fall within the
exception:</p>

<blockquote>
  <p>Cookies used to recognise a user when they return to a website so that the greeting they receive can be tailored </p>
</blockquote>

<p>In your question you explicitly state localStorage to keep a user logged in. LocalStorage is "storing of information in the terminal equipment of a subscriber". If you want to keep a user logged in, the user has performed a log in step. So you provide a service to keep the user logged in, which is exactly what the user wanted. So the exception would apply and you don't need to obtain consent.</p>

<p>For example this stackexchange website also keeps me logged in, so the exception would apply here.</p>

<p>However, you must make sure that you don't use the cookie/localStorage in a way which is incompatible with the exception. For example it would probably not be allowed to use the same cookie to count unique visitors to your website.</p>

<p>If personal data is processed to store login data, <a href="https://gdpr-info.eu/art-6-gdpr/" rel="noreferrer">Art. 6(1)(b) GDPR</a> would probably apply;</p>

<blockquote>
  <ol>
  <li><p>Processing shall be lawful only if and to the extent that at least one of the following applies: </p>
  
  <p>(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p></li>
  </ol>
</blockquote>

<p>So the GDPR would also not require you to ask for permission.</p>

<p>Yes, you need to disclose that you are using cookies.  Your statement <em>"store information about the login data to keep the user logged in through various sessions "</em> implies that you are using the cookie in a way that could be used to create a profile of a natural person and identify them".</p>

<p>This is outlined (unfortunately not with as much clarity as many would like) in <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">Recital 30</a> which is the only part which talks specifically about cookies (ie there is no "cookie law", but their usage falls under broader laws) and reads </p>

<blockquote>
  <p>"natural persons may be associated with online identifiers provided by
  their devices, applications, tools and protocols, such as internet
  protocol addresses, cookie identifiers or other identifiers such as
  radio frequency identification tags. This may leave traces which, in
  particular when combined with unique identifiers and other information
  received by the servers, may be used to create profiles of the natural
  persons and identify them."</p>
</blockquote>
