I would like my web site to be as GDPR friendly as possible. I don’t make use of tracking, advertising or analytics.

On a web site, we might have want to track the following:

  • Login cookies — has this user logged in?
  • Latest Page number in a catalogue.
  • Saved stories — say in local web storage rather than in a cookie.

I’m assuming that the cookies in the first two are effectively part of the requested service, so don’t actually required user consent.

I’m also guessing that the last one, where the data is stored locally and never leaves the browser would also not need consent.

Would this be a reasonable interpretation?

1 Answer 1


The relevant law is the implementation in domestic law of the so-called ePrivacy Directive.

In the the domestic law is Regulation 6 of The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

The law is 'technology neutral', i.e. not just about cookies, it covers any means of storing information or accessing information on a user's device.

You do not need consent for storage or access (a) for "the sole purpose of carrying out a transmission over an electronic communications network" or (b) when the storage or access is "strictly necessary for the provision of an information society service requested by the subscriber or user".

For other storage or access you must provide "clear and comprehensive information about the purposes of the storage of, or access to, that information" and have consent from the user.

For more guidance about the UK's implementation, see the Information Commissioner's Guidance on the use of cookies and similar technologies.

  • That’s the sort of information I’ve been seeing around. My feeling is that the three examples would be covered by that and that I wouldn’t need specific consent?
    – Manngo
    Commented Oct 19, 2023 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .