Back

@sgued @sinbad session cookies only store an ID, which the server uses to fetch server-stored data associated with that ID. Session cookies also expire after a set time of inactivity - has to be less than 15 minutes for ecommerce sites, as per PCI-DSS compliance requirements. Thus session cookies are exempt from opt-in requirements.

Localstorage doesn't support XSS access and thus can't be used for tracking. It also doesn't create files so isn't a privacy concern. LS is exempt from opt-in too.