23

We use the localStorage API to store information about the login data to keep the user logged in through various sessions (we do not store personal information), furthermore the localStorage data is not accessible by third-parties.

Should we show the banner asking for permission to use cookies (the legislation requires to use the name cookie also for similar technologies) anyway?

Improve this question

2 Answers 2

Reset to default
23

The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by Directive 2009/136/EC, where the relevant text of Article 5(3) is found:

  1. Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

This is a Directive, which is not directly binding, member states must implement it in their own law. But there will not be large differences to the text above.

The guidance from the UK's ICO includes useful examples in particular about the exceptions to obtain consent.

There is an exception to the requirement to provide information about cookies and obtain consent where the use of the cookie is:

(a) for the sole purpose of carrying out the transmission of a communication over an electronic communications network; or

(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

The best example is a shopping cart:

This exception is likely to apply, for example, to a cookie used to ensure that when a user of a site has chosen the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, the site ‘remembers’ what they chose on a previous page. This cookie is strictly necessary to provide the service the user requests (taking the purchase they want to make to the checkout) and so the exception would apply and no consent would be required.

And there is a negative example which is unlikely to fall within the exception:

Cookies used to recognise a user when they return to a website so that the greeting they receive can be tailored

In your question you explicitly state localStorage to keep a user logged in. LocalStorage is "storing of information in the terminal equipment of a subscriber". If you want to keep a user logged in, the user has performed a log in step. So you provide a service to keep the user logged in, which is exactly what the user wanted. So the exception would apply and you don't need to obtain consent.

For example this stackexchange website also keeps me logged in, so the exception would apply here.

However, you must make sure that you don't use the cookie/localStorage in a way which is incompatible with the exception. For example it would probably not be allowed to use the same cookie to count unique visitors to your website.

If personal data is processed to store login data, Art. 6(1)(b) GDPR would probably apply;

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

    (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

So the GDPR would also not require you to ask for permission.

Improve this answer
3
  • Does it apply to the Authorisation header? it's technically not a cookie, has a very strict purpose, you need to send it intentionally and it's at least signed and/or encrypted by a server.
    – Eir Nym
    Commented Sep 10, 2018 at 6:40
  • 1
    The so called "Cookie-Law" does not mention it applies to cookies. It it just described as something like "store or retrieve data on/from the user's computer". So it would also apply to adblocker detection scripts and unrequested preloading of updates. But a http-header itself would not apply, it would only apply if the browser would store or retrieve something in reply.
    – wimh
    Commented Sep 10, 2018 at 20:42
  • Thank you, it explains something for me. But I don't know what to show the user as "Cookies" are not used in any way in my application (we don't do any tracking o f user actions). It would be a lie to say "We use cookies to authorize you in a system" as we actually don't use them. But we also don't want to say something "we use this algorithm to check if you's authorised or not" as it's not a user friendly.
    – Eir Nym
    Commented Sep 10, 2018 at 21:25
2

Yes, you need to disclose that you are using cookies. Your statement "store information about the login data to keep the user logged in through various sessions " implies that you are using the cookie in a way that could be used to create a profile of a natural person and identify them".

This is outlined (unfortunately not with as much clarity as many would like) in Recital 30 which is the only part which talks specifically about cookies (ie there is no "cookie law", but their usage falls under broader laws) and reads

"natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."

Improve this answer
4
  • 1
    For keeping user authorised on a web site, Authorisation header could be used. This is not a cookie and it has the very strict purpose. Usually it's encrypted or at least signed, and it never sent by a browser automatically.
    – Eir Nym
    Commented Sep 10, 2018 at 6:35
  • 1
    @eirnym I'd argue that an Authorization header creates a bigger can of worms (no easy logout measure, default logging off associated user spring to mind). While it can be encrypted or signed it generally isnt, because its ancient and only implemented as a quick hack most of the time.
    – davidgo
    Commented Sep 10, 2018 at 7:00
  • I agree with you, but it really depends on implementation. Plain JW(T/K/E/S) doesn't show how to do it, OAuth encorage to use very short-living keys with a reset-key. A logout procedure may require some kind of black listing. For my own services I inject a "session" nonce into a key to check if it present in accessable and fast "Auth storage" and rely on it as the second mandatory check. This has almost the same meaning as "authorization-only" cookie which can't be used anywhere else.
    – Eir Nym
    Commented Sep 10, 2018 at 20:29
  • 1
    If you totally don't trust a client, just remove all cables and batteries from your computers. I prefer to trust a bit.
    – Eir Nym
    Commented Sep 10, 2018 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .