The law states: "a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met."

Paragraph 2 then sets out how consent needs to be obtained, and the test that the subscriber needs to have given their consent before information is stored on their computer.

Cookies, flash cookies, HTML5 databases, etc. are all covered under the general concept of storing on a subscriber's computer.

The original law is here - http://www.legislation.gov.uk/uksi/2003/2426/regulation/6/ma... - and here are the recent amendments - http://www.legislation.gov.uk/uksi/2011/1208/made