GDPR: cookie for login management

Question

I use cookie in my site for login management. I user logs in the cookie dies with the session, if user flags "Keep me logged in" when logging in a long time cookie persists. In the long time cookie I store a hashed informations (user_id,password_hash). It's used to check if user is still logged in in a new session and I use these informations to check if user can access site without relogin. I read in some article about GDPR that technical cookies are allowed without any disclaimer. I can consider my login cookie a technical cookie since I store only these informations? Do I need to show the disclaimer in this case?

Answer 1

From the WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194:

Persistent login cookies which store an authentication token across browser sessions are not exempted under CRITERION B. This is an important distinction because the user may not be immediately aware of the fact that closing the browser will not clear their authentication settings. They may return to the website under the assumption that they are anonymous whilst in fact they are still logged in to the service. The commonly seen method of using a checkbox and a simple information note such as “remember me (uses cookies)” next to the submit form would be an appropriate means of gaining consent therefore negating the need to apply an exemption in this case.

So a cookie to keep a user logged in, requires consent. But the checkbox "Keep me logged in" is appropriate to gain consent. So in your case you do not need to display a cookie banner.