Both cookie and localStorage are just a way to identify session. Basically:

    GET /user/#{localStorage.id}

vs

    GET /user
    Cookie: id=#{Cookie.id}

In both cases GDPR restricts user tracking and allows storing data that's required for domain to function properly.