[seanwilson]

> In general, if you read or write data from a user's device (including cookies, but also things like User Agent from HTTP headers), you need consent unless it's strictly necessary for providing the service that the user requested.

What's the rational behind this if the data stored locally isn't used for user tracking or even uploaded anywhere? By the same logic, why shouldn't we have to ask for consent to cache web files and to store data in a URL parameter?

Thanks for the links. I think part of the problem is there's just so much information and discussion on this, that it's hard to get a clear answer you can be 100% sure you can trust. PECR, GDPR, Irish DPA, ICO, UK law, EU law, cookie sweep... how are you suppose to keep up, know what applies to your particular case, and be sure you've interpreted and collated all the guidelines correctly?

[lmkg]

I hold a certification in information privacy, so my totally-biased answer is "hire an expert!" :p

The reading/writing requirements are from PECR, which is old and dumb. Passed in 2003ish, and was basically ignorable until GDPR changed the definition of consent. Updating it to include GDPR's much-saner concept of "Legitimate Interest" has been a priority goal for several years, but never actually happens.