Beyond Cookies: Managing LocalStorage & IndexedDB

# Beyond Cookies: Managing LocalStorage & IndexedDB **Date:** May 25, 2026 **Author:** Sarah Chen, Privacy Engineer **Category:** Technical **Reading Time:** 11 min --- We call them "Cookie Banners," but GDPR actually regulates "access to information stored in the terminal equipment." That includes: * **Cookies** (Old school, 4KB limit). * **LocalStorage** (Persistent, 5MB+). * **SessionStorage** (Tab-only). * **IndexedDB** (Full database in browser). Many "compliant" sites clear cookies when a user opts out but leave gigabytes of data in LocalStorage. This is a violation. ## The LocalStorage Loophole Trackers love LocalStorage because it never expires (unlike cookies). * **Facebook** uses `_fbp` in cookies but also duplicates IDs in LocalStorage. * **Analytics tools** often cache user events in IndexedDB to retry failed requests. If a user clicks "Reject All," you must wipe *all* of this. ## How GetCookies Handles "Deep Cleaning" ### 1. Auto-Detection GetCookies doesn't just scan `document.cookie`. It wraps the `window.localStorage` and `window.indexedDB` APIs. We detect which *keys* are written by which scripts. * Script: `analytics.js` -> Writes Key: `user_session_v2` ### 2. The "Nuke" Protocol When a user withdraws consent, GetCookies executes a deep clean: ```javascript // Simplified Logic if (consent_withdrawn) { // 1. Kill Cookies deleteCookie('_ga'); // 2. Clear LocalStorage Keys mapped to Analytics localStorage.removeItem('mixpanel_distinct_id'); localStorage.removeItem('hubspot_cart'); // 3. Clear IndexedDB indexedDB.deleteDatabase('firebase_analytics_db'); } ``` ## Developer Best Practices If you write your own code to LocalStorage: 1. **Prefix your keys:** Use `marketing_` or `necessary_`. * `necessary_theme_mode` (Safe) * `marketing_campaign_id` (Requires Consent) 2. **Listen for Events:** ```javascript window.addEventListener('getcookies:consent_updated', (e) => { if (!e.detail.marketing) { localStorage.removeItem('marketing_campaign_id'); } }); ``` ## Conclusion A "Cookie" policy is insufficient in 2026. You need a **Storage Policy**. Ensure your CMP can reach into the browser's deeper storage layers to ensure a true opt-out.