Local storage, session storage and IndexedDB need consent under the same rule as cookies: Article 5(3) of the ePrivacy Directive covers any information stored on, or read from, a visitor's device, whatever the technology. Under the GDPR, the answer is the same with one addition. Article 5(3) decides whether you need consent to store or read the data at all, and the GDPR applies on top when the stored data is personal data, such as a unique identifier. Storage that is strictly necessary for a service the visitor asked for, like a login token, needs no consent.
The law says "information", not "cookies"
Most website owners associate consent requirements with cookies. The actual legal text is broader than that. Article 5(3) of the ePrivacy Directive refers to:
"the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user"
There is no mention of cookies specifically, as the text of the Directive on EUR-Lex shows. Any technology that writes data to or reads data from a visitor's device falls within scope. HTTP cookies are the most common example, but far from the only one. Local storage, session storage and IndexedDB all meet this definition. So do less common mechanisms such as the Cache API and browser fingerprinting techniques that rely on stored information.
The European Data Protection Board confirmed this reading on 7 October 2024, when it adopted the final version of its Guidelines 2/2023 on the technical scope of Article 5(3). The guidelines treat the provision as technology-neutral: it applies to any operation that stores or accesses information on a user's terminal equipment.
What local storage, session storage and IndexedDB are
Before the legal treatment, a short technical overview helps. These three browser APIs serve different purposes, but they all store data on the client side.
Local storage
Local storage (part of the Web Storage API) lets websites store key-value pairs in the browser with no expiry date. Data persists until JavaScript deletes it or the user clears browser data. According to MDN's page on storage quotas, browsers allow up to 5 MiB of local storage per origin. Common uses include saving preferences, theme settings and authentication tokens.
Session storage
Session storage works like local storage, except that data is cleared when the browser tab closes. It is scoped to the tab, so two tabs on the same site have separate session storage, with its own 5 MiB per origin. Typical uses include form progress, temporary interface state and shopping cart data during a session.
IndexedDB
IndexedDB is a full client-side database. It supports structured data, indexes and transactions, and its limits are much higher, a share of the device's disk rather than a fixed few megabytes. Progressive web apps, offline-capable sites and applications that cache large datasets use IndexedDB extensively.
Local storage compared with session storage, cookies and IndexedDB
| Feature | HTTP cookies | Local storage | Session storage | IndexedDB |
|---|---|---|---|---|
| Storage limit | About 4 KB per cookie | 5 MiB per origin | 5 MiB per origin | Much larger, based on disk space |
| Persistence | Set by expiry date | Until deleted | Tab session only | Until deleted |
| Sent with HTTP requests | Yes (automatic) | No | No | No |
| Accessible by JavaScript | Unless HttpOnly | Yes | Yes | Yes |
| Structured data | No (string only) | No (string only) | No (string only) | Yes |
| Covered by ePrivacy Art. 5(3) | Yes | Yes | Yes | Yes |
The final row is the one that matters most. All four technologies are covered by the same legal provision. The size of the data, whether it is sent to a server automatically, and whether it persists beyond a session are technical details. They do not change the legal classification.
When these technologies require consent
Article 5(3) gives two lawful grounds for storing information on a user's device: consent, or strict necessity to provide a service the user explicitly requested. The same test that applies to non-essential cookies applies to local storage, session storage and IndexedDB.
A language preference shows how fine the line is. Keeping a visitor's chosen language in sessionStorage for the visit is strictly necessary for the feature they used. Keeping it in localStorage for months goes further: the EU's Article 29 Working Party treated such preferences as exempt only for the session or a few hours, so persistent storage generally needs consent in the EU. sessionStorage holding items in a shopping cart during checkout is strictly necessary.
Tracking, analytics and advertising uses are a different matter. Storing a user identifier in localStorage to track behaviour across visits requires prior consent, just as setting an analytics cookie like _ga does. An IndexedDB database caching ad targeting profiles also requires consent.
The ICO's guidance on storage and access technologies, last updated on 29 April 2026, covers web storage alongside cookies under regulation 6 of PECR. In France, the CNIL's guidance on cookies and other trackers also covers more than cookies.
The UK exceptions since February 2026
UK sites have more room than EU sites since 5 February 2026. Changes made by the Data (Use and Access) Act 2025 added exceptions to PECR in a new Schedule A1. Storage that only collects statistics to improve your site, or only adapts how the site looks or works to a visitor's preferences, can be used without consent if visitors get clear information and a simple, free way to object. That covers a language preference in localStorage, and first-party analytics identifiers that are not shared for anyone else's purposes. Advertising identifiers still need consent.
Common scenarios and their legal position
Authentication tokens in local storage
Storing a JSON Web Token (JWT) in localStorage after a user signs in is typically classed as strictly necessary. The user explicitly requested access to a protected area, and the token enables that service. Consent is not required for this specific use.
Analytics identifiers in local storage
Some analytics tools store unique identifiers in localStorage instead of cookies to avoid third-party cookie restrictions. This does not change the legal analysis in the EU. The purpose is tracking, which requires consent under Article 5(3) and, where personal data is involved, a legal basis under the GDPR as well.
Offline data in IndexedDB
A progressive web app that caches content in IndexedDB so users can read articles offline is providing a service the user requested. This storage is likely strictly necessary. An IndexedDB database that logs every page view for analytics is not.
Session storage for form data
Saving form input in sessionStorage so users do not lose data if they navigate away by mistake is a usability feature the user benefits from directly. Most regulators would consider this strictly necessary. Storing marketing attribution data in sessionStorage is a different use case that requires consent.
Why cookie scanners often miss these technologies
Traditional cookie scanning tools load pages and record the HTTP cookies that are set. Many do not inspect localStorage, sessionStorage or IndexedDB. That leaves a gap in your inventory.
A site can pass a cookie audit while writing tracking identifiers to local storage. Regulators know this, and the EDPB's 2024 guidelines spell out that the storage technology does not matter.
A thorough cookie audit should include all client-side storage. Use your browser's developer tools: the Application panel in Chrome DevTools shows local storage, session storage and IndexedDB alongside cookies. Kukie.io's cookie scanner records cookies, localStorage and sessionStorage entries on every page it scans. IndexedDB still needs a manual check in DevTools.
What regulators have said
Enforcement specifically targeting local storage or IndexedDB is still rare compared with cookie fines. That does not mean these technologies escape scrutiny.
The ICO's final guidance names web storage as a technology within scope of PECR. The CNIL's guidance on cookies and other trackers has covered other storage since its 2020 guidelines. In Germany, section 25 of the TDDDG (formerly the TTDSG) applies to any storage of or access to information on a device, as explained in the guide to cookie consent in Germany.
As browsers restrict third-party cookies and developers move to other storage, regulators apply the same rules to it.
Audit browser storage the same way you audit cookies
Getting this right does not require a complete overhaul. A few targeted steps close the gap:
- Audit all client-side storage, not just cookies. Check
localStorage,sessionStorageand IndexedDB in your browser's Application panel. - Classify each storage entry by purpose, using the same categories as your cookies: strictly necessary, functional, analytics or marketing.
- Block non-essential storage before consent. If a script writes tracking data to
localStorage, that script must be conditionally loaded after consent, just like a tracking cookie. - Update your cookie policy to mention these technologies. Listing only HTTP cookies when your site also uses local storage gives visitors an incomplete picture.
- Keep local storage and IndexedDB entries in your storage inventory, so you can say what you store on visitors' devices if a regulator asks.
Questions about local storage and consent
Does local storage count as a cookie under GDPR?
Local storage is not a cookie in the technical sense, but it falls under the same legal rules. Article 5(3) of the ePrivacy Directive covers all information stored on a user's device, and the GDPR applies on top if the stored data is personal data.
Do I need consent to use session storage?
It depends on the purpose. Session storage used for strictly necessary functions, like keeping items in a shopping cart, does not require consent. Session storage used for analytics or tracking requires prior consent under Article 5(3) in the EU.
Is IndexedDB covered by the ePrivacy Directive?
Yes. Article 5(3) of the ePrivacy Directive applies to any technology that stores or accesses information on a user's device, and IndexedDB stores data in the browser. The EDPB confirmed this technology-neutral reading in Guidelines 2/2023, adopted in their final form on 7 October 2024.
Can I use local storage to avoid cookie consent requirements?
No. Switching from cookies to local storage does not remove the obligation to obtain consent. The legal requirement is based on storing information on a device, not on the technology used.
Do cookie scanners detect local storage and IndexedDB?
Many basic cookie scanners only detect HTTP cookies. Kukie.io's cookie scanner records localStorage and sessionStorage entries as well, and IndexedDB can be checked in the Application panel of your browser's developer tools.
What happens if I store a JWT token in local storage without consent?
A JWT token stored for authentication after a user signs in is typically classed as strictly necessary, so consent is not required for this use. The exemption applies because the user explicitly requested access to a protected service.
See what your site stores before visitors choose
If you are not sure which cookies and storage entries your site creates, start with a scan. Kukie.io lists the cookies, localStorage and sessionStorage entries your pages write and blocks known trackers until visitors make a choice.
