Yes, they can become persistent once you get consent or other grounds. You probably get that consent in registration form and "recall" it on login. Otherwise you process data from across sessions, which is a huge red flag.