Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to info

Correct; the actual “cookie law” (ePrivacy 2002/58/CE) talks about “the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user”. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... So local storage is also covered by this law. For other fingerprinting techniques, if you can identify a user, GDPR applies. And for ad purposes, the only realistic legal basis is consent.