Local storage
Local storage is the browser's Web Storage API, which lets a website keep key-value data on the device without sending it with every request; legally it is treated like cookies, because it stores information on the user's terminal equipment.The Web Storage API offers two stores per origin: localStorage, which persists until deleted, and sessionStorage, which lasts for the tab's lifetime. Each holds about 5 MB of strings, far more than cookies, and the data is only readable by scripts from the same origin and is never attached to HTTP requests. IndexedDB and the Cache API store even more. Sites use them for preferences, drafts, offline data, and, in many consent tools, for the record of the visitor's cookie choice.
Marketing and analytics scripts use them too, to keep identifiers that survive cookie clearing or to work around browser limits on cookie lifetime. That use is regulated exactly like cookies. Article 5(3) of the ePrivacy Directive speaks of storing information or gaining access to information stored on terminal equipment, not of cookies, and the EDPB's Guidelines 2/2023 confirm that local storage, IndexedDB and similar mechanisms are covered. Reading an identifier from local storage for advertising needs prior consent; storing the consent choice itself is strictly necessary and exempt. The ICO's guidance on storage and access technologies takes the same position for the UK.
A cookie scan that looks only at Set-Cookie headers therefore misses part of the picture, and a cookie policy should mention the storage a site uses beyond cookies. Being "cookieless" is a technical statement, not a legal one: see the cookie entry and the ePrivacy Directive page.