Yes, localStorage is in scope
The relevant provision covers storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user. It is technology-neutral by design. localStorage, sessionStorage, IndexedDB and cache-based tricks are all forms of storing information on the device, and all fall within the same rule as cookies.
Swapping a tracking cookie for a localStorage identifier changes nothing legally. It is the same processing with different plumbing.
The exemption that matters
Consent is not required where the storage is strictly necessary to provide a service explicitly requested by the user. Applied to localStorage, that generally covers things like:
- The contents of a shopping cart
- The state of a form the user is filling in, so a reload does not lose their work
- A session token that keeps the user logged in
- The record of the user's own consent or preference choices
- An interface preference the user actively set, such as a chosen language or a dark-mode toggle
The common thread is that the user asked for the thing, directly or by obvious implication, and the feature would not work without it.
What is not exempt
- A visitor identifier used to recognise someone across sessions for analytics
- A/B test assignment for experiments the visitor did not request
- Advertising or attribution identifiers
- Behavioural profiles built up over time
- Anything shared with a third party
The test is not whether the data feels harmless. It is whether the storage exists to deliver something the user asked for, or to serve a purpose of yours.
A useful way to decide
For each item you store, answer two questions:
1. If I deleted this, would a feature the user asked for stop working?
2. Is it used to recognise this person again later?
Yes to the first and no to the second: probably exempt. Any other combination: assume consent is required, or remove it.
Duration counts
Even for storage that is genuinely necessary, keep it proportionate. A session-scoped item that disappears when the tab closes is easier to justify than one with a one-year lifetime. Regulators have consistently taken the view that data minimisation applies to duration as well as to content.
What this means for analytics
An analytics tool that stores a visitor identifier in localStorage instead of a cookie needs consent exactly as a cookie-based one would. A tool that stores nothing at all on the device — no cookie, no localStorage, no fingerprint — is a genuinely different case, and it is the reason cookieless analytics can be run without a banner.
If a vendor markets a product as "cookieless", the useful follow-up question is not about cookies. It is: what exactly do you store on the visitor's device, and what do you read from it?
General information, not legal advice — confirm your specific setup with a qualified lawyer.