OK, it really doesn't matter what tech you're using. You should be asking for affirmative consent if you're storing data that can affect privacy. Of course, _everything_ affects privacy these days, so even the exemptions for shopping cart data are kind of silly.

Cookies is a pretty household term - but distinct from local storage, so I wonder if sites are using that as a loophole.