Skip to main content
Cookie Gate
Category: Tracking Technologies

Session Storage

Also known as: sessionStorage, Web Storage (session)
Simply put

Session Storage is a way for websites to temporarily store small pieces of information in your browser while you have a page open. Unlike some other storage methods, the data is kept only for a single browsing session and is generally deleted when you close the tab or browser. It works separately from cookies but serves a similar purpose of remembering information as you use a site.

Formal definition

Session Storage is a mechanism of the browser's Web Storage API, accessed via the read-only Window.sessionStorage property, that stores key/value string pairs scoped to the current origin. Data persists only for the duration of a single page session and is typically cleared when the tab or browser is closed, and it is generally isolated per tab rather than shared across the origin like localStorage. Although not literally a cookie, session storage stores and retrieves information on the user's device; where it is used for non-essential purposes such as analytics or advertising, it may fall within the same consent obligations as cookies under EU and UK ePrivacy rules, which govern the storing of or access to information on a user's terminal equipment regardless of the specific technology. Whether prior consent is required generally depends on the purpose of the storage and the applicable jurisdiction; strictly necessary uses are typically exempt in most EU jurisdictions, while requirements differ under US state privacy laws. This definition addresses the technology itself and does not resolve fact-specific questions about any particular implementation's consent status.

Why it matters

Session Storage matters for compliance because the ePrivacy rules in the EU and UK govern the storing of, or access to, information on a user's terminal equipment regardless of the specific technology involved. Although session storage is not literally a cookie, it stores and retrieves data on the user's device, which means that where it is used for non-essential purposes such as analytics or advertising, it may fall within the same prior-consent obligations that apply to cookies. Consent banners and audits that focus only on cookies can therefore overlook a category of storage that carries similar obligations.

Because session storage data is generally deleted when the tab or browser is closed and is typically isolated per tab, it is sometimes assumed to be lower-risk or exempt. That assumption is not reliable as a matter of law: under EU and UK ePrivacy rules the question of whether prior consent is required generally turns on the purpose of the storage rather than its persistence or technical characteristics. Strictly necessary uses are typically exempt in most EU jurisdictions, while non-essential uses may require consent. Requirements differ under US state privacy laws, which often rely on opt-out rather than opt-in mechanisms.

For compliance teams, the practical significance is that a technology inventory and consent assessment should account for web storage mechanisms alongside cookies. Whether any particular use of session storage requires consent is fact-specific and depends on its purpose and the applicable jurisdiction, so it should be assessed case by case rather than assumed to be outside scope.

Who it's relevant to

Privacy officers and data protection professionals
Those responsible for cookie and tracking-technology inventories should include session storage in their assessments, since EU and UK ePrivacy rules can apply to storage on a user's device regardless of whether it is technically a cookie. Whether prior consent is required generally depends on the purpose of the storage and the applicable jurisdiction, so each use should be evaluated on its facts.
Web developers and engineers
Developers implementing session storage should be aware that, although the data is tab-scoped and typically cleared when the tab or browser closes, its use for non-essential purposes such as analytics or advertising may carry consent obligations comparable to cookies under EU and UK rules. Coordinating with compliance teams on the purpose of each storage use helps ensure it is handled appropriately.
Legal counsel and compliance teams
Counsel advising on consent management should recognize that the ePrivacy analysis turns on the purpose of storage rather than the specific technology, meaning session storage can fall within the same framework as cookies. Requirements differ across the EU, UK, and individual US states, so the applicable jurisdiction must be identified before concluding whether consent or an opt-out mechanism applies.

Inside Session Storage

Web Storage API scope
Session storage is part of the browser's Web Storage API, alongside local storage. It stores key-value string data within the browser, scoped to a single origin (protocol, host, and port combination).
Per-tab, session-bound lifetime
Data placed in session storage persists only for the lifetime of a single browser tab or window. It is cleared when the tab is closed, and unlike local storage, it is not shared across other tabs even for the same origin.
Client-side storage, not a cookie
Session storage is not literally a cookie; its contents are not automatically transmitted to the server with each HTTP request. However, under the ePrivacy Directive and its national implementations in the EU, the rules on storing or accessing information on a user's device generally apply to similar technologies, so session storage can fall within the same consent framework as cookies depending on how it is used.
Purpose-dependent legal treatment
The consent implications depend on what session storage is used for. Where it supports functionality strictly necessary for a service the user has requested, it may fall within a consent exemption in most EU jurisdictions; where it is used for analytics, advertising, or tracking purposes, prior consent is typically required under EU law.
Potential to hold personal data
If the values stored constitute personal data, the GDPR may govern their subsequent processing. The ePrivacy rules on placing or accessing the information and the GDPR on any resulting processing are separate obligations and should not be treated as satisfied by a single step.

Common questions

Answers to the questions practitioners most commonly ask about Session Storage.

Is session storage exempt from consent because it is not technically a cookie?
No. Although session storage is part of the Web Storage API rather than an HTTP cookie, the ePrivacy rules that apply in most EU jurisdictions cover the storing of information on, or gaining access to information already stored in, a user's device regardless of the specific technology used. Session storage falls within the same framework as cookies, pixels, local storage, and SDKs. Whether consent is required therefore depends on the purpose it serves, not on the fact that it is not literally a cookie.
Does data in session storage never require consent because it is deleted when the tab closes?
Not necessarily. The fact that session storage is cleared at the end of the browsing session affects how long the information persists, but it does not by itself determine whether consent is needed. The relevant question in most EU jurisdictions is whether the storage or access is strictly necessary to provide a service the user has requested. If session storage is used for analytics, advertising, or other non-essential purposes, prior consent may be required even though the data is short-lived.
How do we decide whether a particular use of session storage needs consent?
Assess the purpose. Where session storage is strictly necessary to deliver a service the user has explicitly requested, it may fall within the consent exemption recognised in many EU jurisdictions. Where it supports analytics, advertising, personalisation, or other non-essential functions, prior consent is typically required under EU law. Because the classification turns on the specific facts and can be contested, this assessment should be documented and reviewed with legal input rather than assumed.
Should session storage be listed in our cookie or tracking-technology disclosures?
In most EU jurisdictions, transparency obligations extend to storage technologies beyond cookies, so session storage used for non-essential purposes should generally be described in the same disclosures that cover cookies and similar technologies. Listing the technology, its purpose, and its duration helps satisfy the requirement that consent be informed. The precise disclosure expectations vary by jurisdiction and by the guidance of the relevant data protection authority.
How should session storage be handled when a user declines or withdraws consent?
For uses that require consent, session storage that serves non-essential purposes should generally not be written before a valid affirmative action is recorded, and existing entries associated with those purposes should be removed or not created if the user declines or later withdraws consent. Withdrawal should be as easy as giving consent. The technical mechanism for clearing session storage should be tested to confirm it reflects the user's current choices.
Can a consent management platform (CMP) control writes to session storage?
A CMP can help gate and record when scripts that write to session storage are allowed to run, but this depends on how the site is built. Session storage set directly by first-party code or by scripts that load outside the CMP's control may not be blocked automatically. A CMP supports compliance by managing consent capture, signalling, and logging, but it does not replace the need to map where session storage is used and to apply legal judgment to each purpose.

Common misconceptions

Session storage does not require consent because it is not a cookie.
In the EU, the ePrivacy rules on storing or accessing information on a user's device generally extend to technologies beyond literal cookies, including web storage. Whether consent is required depends on the purpose, not the label; non-essential uses such as analytics or advertising typically require prior consent, while strictly necessary uses may be exempt in most EU jurisdictions.
Because session storage clears when the tab closes, it is inherently privacy-safe and out of scope for compliance.
A short or session-bound lifetime does not remove data from scope. If the data is personal data or the storage supports tracking or non-essential purposes, ePrivacy consent obligations and, where applicable, GDPR processing obligations may still apply during the session.
Consent obligations for session storage are the same everywhere.
Obligations vary by jurisdiction. EU and UK regimes generally rely on prior consent for non-essential storage, whereas US state privacy laws such as the CCPA and CPRA in California often operate on an opt-out model. The applicable scope should be assessed per jurisdiction.

Best practices

Inventory every use of session storage on your properties and classify each by purpose (strictly necessary versus analytics, advertising, or other non-essential uses) to determine whether a consent exemption may apply in the relevant jurisdiction.
Treat session storage under the same ePrivacy analysis as cookies in EU and UK contexts, and separately assess whether the stored values constitute personal data triggering GDPR obligations.
Where session storage serves non-essential purposes in the EU, obtain valid prior consent through a clear affirmative action before writing to it, rather than relying on pre-ticked boxes, implied consent, or continued browsing.
Configure your consent management platform to gate non-essential session storage until the relevant consent is captured, and remember that the CMP supports but does not by itself guarantee legal compliance.
Map obligations per jurisdiction, distinguishing opt-in expectations in the EU and UK from opt-out mechanisms under US state laws such as the CCPA and CPRA, and honor recognized signals such as Global Privacy Control where applicable.
Document and log the basis for each session storage use, including whether it is claimed as strictly necessary, and seek legal review for uses whose classification is contested or fact-dependent.