I thought "remember this device" more typically worked via a combination of browser fingerprinting (which can be pretty sophisticated, e.g. even relying on rendering behaviours) and local storage, which may or may not involve cookies.