How do I comply with GDPR on a website using cookies and local storage?

Question

I would like to use cookies and local storage on my website is there anything I need to do to comply with GDPR in the EU.

I know about cookie banners but I don't know if that is what I should be using for local storage.

I'm going to be using them to identify users that are logged in.

What sort of things do I need on my website, and what should the message say, stop using my website if you do not give consent to use cookies? Cookies may be stored on your device if you use this website?

---

Thanks to anyone who answers.

Answer 1

If you use cookies or local storage for essential functionality, such as sessions for logging users in, you do not have to put up any banners and such.

Specifically, cookies for login sessions are often used as an example of "technical cookies" that can be used without consent.

However, if you use those cookies, for example, to track your users or collect any data whatsoever for other then non-essential purposes (sharing them with others, marketing, ...), you need to get consent from those users and provide the option to withdraw that consent.

---

The law has evolved a bit (at least in my country) since this answer has been written. To be more sure your usage of cookies is legal, inform the user you are using technical cookies, for example, with a small but visible banner. Additionally, I would at least recommend putting a link in the banner and your footer that briefly explains the following:

• What are cookies, and why are you using them.
• Table of technical cookies you use and why (cookies name, expiry date, domain, ..., and purpose).

If you use other than strictly technical cookies, the law in some countries (analytics, marketing, preferences) requires you to categorize them and request consent to each category. Usage of non-technical cookies is a bit tricky, as there are tons of crazy rules; I highly recommend reading up on them, especially for EU countries.

I am not a lawyer, follow the advice at your own risk