The five stores inside a browser
Cookies are only one of several ways to leave something on someone else's device. The others appear in no cookie list, some survive clearing cookies – and all fall under the same rules.
Looking for cookies in a browser turns up cookies. Neighbouring stores stay invisible in the process, although they do the same job and some hold far more. For the legal assessment the construction is irrelevant: section 25 TDDDG speaks of information on the terminal device, not of cookies.
Five stores, from fleeting to lasting
- Session storageEnds with the tab. Applies to that one window only – the least intrusive route.
- CookieAbout 4 kilobytes, with a set expiry. Sent along automatically with every request.
- Local storageSeveral megabytes, with no expiry date. Stays until someone actively clears it.
- IndexedDBA full database inside the browser. Meant for offline applications, equally usable for identifiers.
- Cache and service workersMeant for speed. Can be repurposed, because a cache too can be made recognisable.
Why the distinction matters in practice
Three consequences follow, all of them affecting everyday work on a website.
First: a cookie register listing only cookies is incomplete. The duty to inform covers every store, not one construction.
Second: someone withdrawing consent expects the store to be cleared. A banner that deletes only cookies on withdrawal and leaves local storage in place is not implementing the withdrawal.
Third: browsers clear the stores unevenly. Resetting cookies leaves IndexedDB untouched – recognition survives a clean-up that the person assumed had worked.
What may be stored without consent
- The session identifier of a login, as long as it carries nothing but the login.
- The shopping basket of a shop – the requested service could not be delivered without it.
- The cookie decision itself. Asking for it again would be self-defeating.
- Security tokens against abusive form submissions and session hijacking.
- A language setting or the choice between light and dark appearance, where it was made deliberately.
The common denominator of that list: each entry serves the reason the page was opened, and none of them is passed to third parties. As soon as one of those two ceases to hold, the exception ends – regardless of which of the five stores the entry sits in.