gdpr
GDPR: cookie for login management
<p>I use cookie in my site for login management.
I user logs in the cookie dies with the session, if user flags "Keep me logged in" when logging in a long time cookie persists.
In the long time cookie I store a hashed informations (user_id,password_hash). It's used to check if user is still logged in in a new session and I use these informations to check if user can access site without relogin.
I read in some article about GDPR that technical cookies are allowed without any disclaimer.
I can consider my login cookie a technical cookie since I store only these informations?
Do I need to show the disclaimer in this case?</p>

<p>From the <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf" rel="noreferrer">WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194</a>:</p>

<blockquote>
  <p>Persistent  login  cookies  which  store  an  authentication  token 
  across  browser  sessions  are  not  exempted under CRITERION B. This
  is an important distinction because the user may not be  immediately 
  aware  of  the  fact  that  closing  the  browser  will  not  clear 
  their  authentication  settings. They may return to the website under
  the assumption that they are anonymous whilst  in fact they are still
  logged in to the service. The commonly seen method of using a
  checkbox  and a simple information note such as “remember me (uses
  cookies)” next to the submit form  would  be  an  appropriate  means 
  of  gaining  consent  therefore  negating  the  need  to  apply  an 
  exemption in this case.</p>
</blockquote>

<p>So a cookie to keep a user logged in, requires consent. But the checkbox "Keep me logged in" is appropriate to gain consent. So in your case you do not need to display a cookie banner.</p>
