The official EU-legislation does not use the word "cookies", except in the recitals. The "Cookie-Law" is part of the Privacy and Electronic Communications Directive 2002/58/EC and is amended by Directive 2009/136/EC, where the relevant text of Article 5(3) is found:
- Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal
equipment of a subscriber or user is only allowed on condition that
the subscriber or user concerned has given his or her consent, having
been provided with clear and comprehensive information, in accordance
with Directive 95/46/EC, inter alia, about the purposes of the
processing. This shall not prevent any technical storage or access for
the sole purpose of carrying out the transmission of a communication
over an electronic communications network, or as strictly necessary in
order for the provider of an information society service explicitly
requested by the subscriber or user to provide the service.
This is a Directive, which is not directly binding, member states must implement it in their own law. But there will not be large differences to the text above.
The guidance from the UK's ICO includes useful examples in particular about the exceptions to obtain consent.
There is an exception to the requirement to provide information about cookies and obtain consent where the use of the cookie is:
(a) for the sole purpose of carrying out the transmission of a communication
over an electronic communications network; or
(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.
The best example is a shopping cart:
This exception is likely to apply, for example, to a cookie used to ensure that when a user of a site has chosen the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, the site ‘remembers’ what they chose on a previous page. This cookie is strictly necessary to provide the service the user requests (taking the purchase they want to make to the checkout) and so the exception would apply and no consent would be required.
And there is a negative example which is unlikely to fall within the
Cookies used to recognise a user when they return to a website so that the greeting they receive can be tailored
In your question you explicitly state localStorage to keep a user logged in. LocalStorage is "storing of information in the terminal equipment of a subscriber". If you want to keep a user logged in, the user has performed a log in step. So you provide a service to keep the user logged in, which is exactly what the user wanted. So the exception would apply and you don't need to obtain consent.
For example this stackexchange website also keeps me logged in, so the exception would apply here.
However, you must make sure that you don't use the cookie/localStorage in a way which is incompatible with the exception. For example it would probably not be allowed to use the same cookie to count unique visitors to your website.
If personal data is processed to store login data, Art. 6(1)(b) GDPR would probably apply;
Processing shall be lawful only if and to the extent that at least one of the following applies:
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
So the GDPR would also not require you to ask for permission.