localStorage and cookies are the same in terms of GDPR. It encompasses all local storage mechanisms such as IndexedDB, cookies, localStorage, sessionStorage, etc.

(source: I read the directive way back when it came out, and also skimmed large sectoins of GDPR)

Other sources: https://softwareengineering.stackexchange.com/questions/2905... and https://law.stackexchange.com/questions/30739/do-the-gdpr-an...

I’m not a lawyer, but I’d be shocked if you could get around gdpr by using a different api. If gdpr was actually limited to `document.cookie` and `Set-Cookie` it’d be a laughable attempt to protect users.