Cookies vs local storage
Cookies and localStorage both store data in your browser, but they behave differently — and a common myth is that using localStorage instead of cookies avoids consent rules. It does not.
The technical difference
Cookies are sent to the server with every request, are size-limited (around 4KB), and can have expiry dates. localStorage is larger (megabytes), stays in the browser and is never automatically sent to the server — JavaScript reads it when needed. sessionStorage is the same but cleared when the tab closes.
In short: cookies are for things the server needs to see on each request (like your session); localStorage is for things only the page's JavaScript needs.
Why local storage is not a consent loophole
The EU ePrivacy rule is about "storing or accessing information on a user's device" — it is deliberately technology-neutral. It covers cookies, localStorage, IndexedDB, and similar. So if you use localStorage to hold an analytics or advertising identifier, you still need consent first, exactly as you would for a cookie.
A scanner that only looks for cookies can miss this; a good scan looks at trackers and scripts too, not just the cookie jar.
Cookies like this
_ga— Google Analyticsajs_anonymous_id— Segment
Scan any website and we'll list every cookie it sets — categorised, with the ones that load before consent flagged.
Related guides
General information to help you understand cookies — not legal advice.