I'd like to avoid having the cookies banner on my websites where possible. Could I store session id's in localStorage to bypass implementing the banner?

closed as off-topic by gnat, Robert Harvey, BobDalgleish, Bart van Ingen Schenau, 8bittree Jul 31 '17 at 21:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking for legal advice or aid are off-topic here. You may be able to get help with understanding, applying, and complying with free and open licenses on Open Source. You may be able to get help with legal terms, concepts, language, and procedures on Law." – gnat, Robert Harvey, BobDalgleish, Bart van Ingen Schenau, 8bittree
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 22 down vote accepted

If you don't use cookies at all then it would be a huge misinformation to warn your visitors about using cookies. It may even be useful to explicitly state that you don't use cookies. Remember that warnings about cookies are for people who want to avoid cookies so they should know when they finally get to a rare website that doesn't use them. But you may still need to warn about other things, like local storage. Just don't call it cookies if those are not cookies because it would be a misinformation that can even be against the law.

According to The EU Cookie Law website:

Is is just cookies?

No - The law also affects anything that acts like a cookie, for example:

  • Flash Cookies
  • HTML5 Local Storage

The ICO has said that it isn't good enough to just re-implement the tracking some other way outside of cookie storage.

According to The Cookie Collective:

There are other technologies, like Flash and HTML5 Local Storage that do similar things, and these are also covered by the legislation, but as cookies are the most common technology in use, it has become known as the Cookie Law.

See also:

  • 3
    "warnings are for people who are afraid of cookies" - that is blatantly wrong. The warnings are mandated by the directive and the directive does not even mention cookies. Any kind of tracking and surveillance is covered. – JacquesB Sep 2 '15 at 14:31
  • 1
    This is just my interpretation, and could be wrong, but as i understand it, if you use local storage in a way that doesn't allow you to identify individual users, it doesn't apply, so for example using local storage to store user preferences wouldn't require notification, but using it to store a session id that then automatically gets sent back to the server would. – Jules Sep 2 '15 at 20:00
  • @Jules: You are correct. You can also use cookies without having to notify the user. It is not a question of any specific tracking method, but rather if you store the traffic data or share it with third parties. – JacquesB Sep 2 '15 at 20:41
  • @JacquesB I didn't mean that the warnings about cookies are mandated by the directive but that warning about cookies specifically on a website that doesn't use them would be misleading. I reworded that sentence, I hope it is more clear now. Thanks for pointing it out. – rsp Sep 9 '15 at 12:04
  • 5
    People that are afraid of cookies have their browsers set to reject all cookies. Smart people control cookies with their browser, use private browsing, and constantly clear their cache. When I go to the store and use my credit card the POS can record everything about my purchases and analyze my private life yet nothing pops up on the checkout terminal asking for my permission or offering more information. The law is an ignorant misguided attempt. People don't want to be interrupted by a banner to click however unobtrusive it is made to be. The law should be disregarded altogether. Screw the EU – J.Money Feb 25 '16 at 13:47

The cookie law is not actually about cookies (and its not actually called the cookie law). Its about tracking users, storing and sharing the information with third parties. Cookies are just the most popular method to track users.

If you don't want to show the "cookie warning" then just don't track the users beyond the session and don't share traffic data with third parties.

The actual directive.

  • You said “don't track the users beyond the session”. Do you think it would be legal to use sessionStorage for website analytics? sessionStorage gets deleted as soon as the user closes the browser tab. – ausi Nov 24 '16 at 19:12
  • @ausi: Sure...if you don't store the analysis anywhere. But that would be pretty useless. – JacquesB Nov 24 '16 at 19:19
  • I meant using the sessionStorage for storing a unique tracking id and using that to send data to an analytics server. This way, after closing the browser tab, the analytics server can no longer identify the same user. But as long as the website is opened it can identify the browsing session. – ausi Nov 24 '16 at 19:25
  • 2
    @ausi: This is basically the same as a session cookie. I believe you still have to warn even if the analysis data is anonymized. – JacquesB Nov 24 '16 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.