With the arrival of the General Data Protection Regulation (GDPR) in 2018, many misconceptions circulate around the limits, best practices, but also techniques for circumventing the regulation.

One of these misconceptions is the following: LocalStorage, unlike cookies, would not be subject to the same rules as the latter.

So what is really the case? That's what we're going to find out!

What is LocalStorage?

We won't go into detail about how localStorage works in this article, but will simply give a quick reminder.

If needed, you'll find a dedicated article on LocalStorage on our blog.

LocalStorage is a browser feature that allows data to be stored locally, with no expiration date.

Unlike cookies, this data is not automatically sent to servers during HTTP requests. However, it remains accessible by any script running on the web page.

What does the GDPR say about LocalStorage?

This is where confusion often arises. The GDPR does not list specific technologies, and rightly so, because the legal text would become obsolete too quickly.

So what exactly are we talking about? In the regulation's definitions, we speak of "data processing," in these terms:

Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (source)

As you will have understood, this definition encompasses cookies, localStorage and all other data processing methods.

User consent

Put simply, the GDPR considers any data that allows a user to be identified directly or indirectly as personal data.

If a website uses LocalStorage to store a unique identifier, settings, or session information, this is therefore considered to be processing of personal data.

At the European level, the ePrivacy directive also extends these rules to all technologies for storing or accessing information on a device, such as fingerprinting

In summary

Since the GDPR is agnostic to any technology used to store data that allows a user to be identified, yes, LocalStorage is regulated in the same way as cookies!