# Does cookie consent cover localStorage, pixels and fingerprinting?

> Why EU consent rules apply to localStorage, tracking pixels, fingerprinting and other non-cookie technologies, based on Article 5(3) ePrivacy and EDPB Guidelines 2/2023.

Source: https://www.cookiesh.eu/blog/consent-beyond-cookies  
Published: 2026-10-29

## Key takeaways

- The EU cookie rule in Article 5(3) of the ePrivacy Directive is technology-neutral: it covers storing or accessing any information on a user's device, not just cookies.
- localStorage, sessionStorage, IndexedDB, tracking pixels and fingerprinting scripts all need consent unless they are strictly necessary for a service the user asked for.
- EDPB Guidelines 2/2023 confirm that a site gains access to information when it instructs the browser to send it, which covers pixels and JavaScript that reads device characteristics.
- The rule applies whether or not the information is personal data, and whoever triggers the storage or access is responsible for it.
- Switching from cookies to another technology does not remove the need for consent; only changing what you store or read can do that.

Yes. The EU cookie rule in Article 5(3) of the ePrivacy Directive never mentions cookies. It covers storing information on a user's device and gaining access to information already there, by any technology. localStorage, IndexedDB, tracking pixels and fingerprinting scripts are all in scope, and the European Data Protection Board confirmed as much in its Guidelines 2/2023.

## What does the law actually say?

Article 5(3) says that storing information, or gaining access to information already stored, in the terminal equipment of a user is only allowed with the user's consent, after they have been given clear and comprehensive information. There are two exemptions: storage or access needed only to transmit a communication, and storage or access strictly necessary to provide a service the user explicitly requested.

The word "cookie" appears only in the recitals, as an example. The obligation itself is defined by what happens on the device, not by the mechanism. That is why "cookie law" is a misleading name and why moving tracking data out of cookies does not move it out of the law. For how this rule interacts with GDPR, see [ePrivacy Directive vs GDPR](/blog/eprivacy-directive-vs-gdpr).

## What did EDPB Guidelines 2/2023 clarify?

The EDPB published Guidelines 2/2023 to settle arguments about the technical scope of Article 5(3), and finalized them in 2024. The guidelines break the rule into elements and interpret each broadly.

- **Information** means any information, not just personal data. A random identifier or a device setting counts.
- **Terminal equipment** is any device that connects to a network: a laptop, phone, smart TV or connected car.
- **Storing** covers any write to the device, whether in cookies, browser storage, cache or files.
- **Gaining access** happens whenever an entity takes steps to get information from the device. Instructing the browser to send information counts, even if no one reads the storage directly.

The last point matters most. Under this reading, a script that asks the browser for its screen resolution, installed fonts or graphics fingerprint is gaining access, and so is an image tag that makes the browser send a request carrying identifiers.

The EDPB also walks through specific use cases, including tracking pixels, tracking links, data processed locally and then sent back, some forms of IP-based tracking, connected devices and unique identifiers. In each, the question is the same: did someone cause information to be stored on, or sent from, the user's device?

## Which technologies need consent?

Apply the same test to every technology: if it stores or reads information on the device and is not strictly necessary for something the user asked for, it needs consent.

| Technology | In scope of Article 5(3)? | Common use that needs consent |
| --- | --- | --- |
| HTTP and JavaScript cookies | Yes | Analytics and advertising identifiers |
| localStorage and sessionStorage | Yes | Analytics client IDs, session replay buffers |
| IndexedDB and Cache Storage | Yes | Cached ad or tracking data |
| Tracking pixels (web and email) | Yes, per the EDPB | Conversion tracking, email open tracking |
| Fingerprinting scripts | Yes, per the EDPB | Cross-site identification without cookies |
| Tracking parameters in links | Can be, depending on how the identifier is set and read | Click and campaign attribution |

The table is a starting point, not a verdict. A pixel used only to load a decorative image is not tracking anything, while a "cookieless" analytics script that builds a stable device hash usually is.

## Does the strictly necessary exemption still apply?

Yes, and it is technology-neutral too. If something is strictly necessary to provide a service the user explicitly requested, you can store or read it without consent, whatever the storage mechanism.

Typical examples in localStorage:

```js
// Strictly necessary: the user asked for these features
localStorage.setItem('cart', JSON.stringify(cartItems));
localStorage.setItem('locale', 'de');
localStorage.setItem('consent', JSON.stringify(choices)); // remembering the choice itself

// Needs consent: identifies the device for analytics or advertising
localStorage.setItem('analytics_client_id', crypto.randomUUID());
```

The test is purpose, not technology. The same key can be exempt in one use and need consent in another, so do not reuse a necessary value, such as a session ID, for analytics. For a fuller list, see [what counts as a strictly necessary cookie](/blog/strictly-necessary-cookies).

## Does fingerprinting avoid the consent requirement?

No. Fingerprinting is often sold as a way around cookie banners, but it depends on reading device characteristics through the browser, which the EDPB treats as gaining access to information on the device. It needs consent, and because users cannot see or clear a fingerprint the way they can clear cookies, regulators tend to view it as more intrusive, not less.

The same applies to "cookieless" vendors that build a persistent identifier from device signals. If you want analytics without consent, the honest route is to collect less: aggregate counts with no persistent identifier. See [cookieless analytics: what works without consent](/blog/cookieless-analytics) for the options.

## What should I do on my site?

Treat every storage or access technology as if it were a cookie.

1. **Inventory everything.** Your [cookie audit](/blog/how-to-run-a-cookie-audit) should list localStorage, sessionStorage and IndexedDB keys, outgoing pixel requests and scripts that read device characteristics, not only cookies.
2. **Classify by purpose.** Mark each item as strictly necessary or as analytics, marketing or functional, using the same categories as your banner.
3. **Block before consent.** Hold back scripts and pixels that write or read non-essential data until the user agrees. See [how to block third-party scripts until consent](/blog/block-scripts-until-consent).
4. **Disclose it.** Your cookie policy should name non-cookie technologies too, with their purpose and lifetime.
5. **Clean up on refusal or withdrawal.** Remove non-essential keys from browser storage when a user says no, just as you would delete cookies.

## Bottom line

EU consent rules follow what happens on the device, not what the technology is called. If you store or read anything for analytics, advertising or tracking, whether in a cookie, in localStorage, through a pixel or by fingerprinting, you need consent first. Tools like Cookiesh scan for cookies, storage keys and third-party requests together, so non-cookie tracking shows up in the same inventory as everything else.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Is localStorage exempt from cookie consent because it is not sent to the server?

No. Article 5(3) is about storing and reading information on the device, not about how it travels. If a script writes an analytics or advertising identifier to localStorage and reads it later, that needs consent like a cookie.

### Is fingerprinting a way to avoid the consent requirement?

No. Fingerprinting works by having the browser report characteristics such as screen size, fonts or graphics output. The EDPB treats that as gaining access to information on the device, so it needs consent unless an exemption applies.

### Do tracking pixels in emails need consent too?

Yes, in the EDPB's view. When an email client loads a tracking pixel, the request sends information from the device to the sender, which falls under Article 5(3). Many marketers now rely on consent collected at sign-up for this.

### Can I use localStorage without consent for things like a shopping cart?

Yes. The strictly necessary exemption applies to any storage technology. Keeping cart contents, language settings or a consent choice in localStorage is fine, as long as you do not reuse that data for analytics or advertising.

## Sources

- [Directive 2002/58/EC (ePrivacy Directive), EUR-Lex](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive, EDPB](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en)