# GDPR - prevent ghost-history in local storage **URL:** \ **Category:** Developer help\ **Created:** [March 7, 2023, 4:26pm UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903 "2023-03-07T16:26:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![martin\_sk](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/martin_sk/32/22942_2.png) [@martin\_sk](https://forum.ghost.org/u/martin_sk)\ **Post date:** [March 7, 2023, 4:26pm UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903/1 "2023-03-07T16:26:56Z")
Hey there, I’m trying to be extra careful about the privacy at the website I’m responsible for and I’ve been assigned the task to make sure it’s GDPR-compliant. First of all - I’m grateful and want to thank the whole Ghost Team for not using cookies when they aren’t necessary! 🙏 (as mentioned here - [What about cookies?](https://forum.ghost.org/t/what-about-cookies/8351)) But I noticed that there’s a _ghost-history_ key in the Local storage and it’s updated every time I visit different URL along with the timestamp and some referrer references. I have two questions (well technically 3) regarding this: 1. What is the purpose of saving the browsing history on client side? Is it interconnected with the analytics functionality (that can be set-up on /ghost/#/settings/analytics) or is it completely independent of the integrated analytics? 2. Is there any way to prevent the _ghost-history_ from even being created? If visitor refuses to accept site saving “cookies” and related data to their browser. Thanks in advance for any input on this 🙂 ---
**Author:** ![mjw](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/mjw/32/30781_2.png) [@mjw](https://forum.ghost.org/u/mjw)\ **Post date:** [March 7, 2023, 6:37pm UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903/2 "2023-03-07T18:37:48Z")
I believe you are referring to ghost-members-ssr. This is used to keep a user logged in, and is an exception under “storing of information in the terminal equipment of a subscriber”. That is, it’s only used by somebody who has signed up to the site; it’s not present otherwise. Accordingly, consent is not required under GDPR. Without this, a user could not stay logged in when navigating the site. ---
**Author:** ![martin\_sk](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/martin_sk/32/22942_2.png) [@martin\_sk](https://forum.ghost.org/u/martin_sk)\ **Post date:** [March 7, 2023, 7:21pm UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903/3 "2023-03-07T19:21:37Z")
Hi mjw, thank You very much for Your reply, but I think we are talking about two different parts of the app. Members SSR seems to be taking care of logging in the subscribed users, by generating the _ghost-members-ssr_ and _ghost-members-ssr.sig_ cookies, which seems to be perfectly reasonable thing to do and should be considered as kind of necessary cookies for the system to be working like it’s supposed to. What I’m wondering about is the member-attribution ([Ghost/member-attribution.js at main · TryGhost/Ghost · GitHub](https://github.com/TryGhost/Ghost/blob/main/ghost/core/core/frontend/src/member-attribution/member-attribution.js)) created Local storage item and whether I could mark it as necessary in the list of the ~~cookies~~ things I’m saving in the visitor’s browsers. And if not, how to prevent this item to be created in the first place, if user refused saving any content on their device. Maybe I’m overthinking this whole GDPR stuff, and please just tell me if that’s the case, but if this functionality just makes a list of visited urls and saves it in the client’s browser’s local storage it kind of feels like something that isn’t strictly necessary for the site to be working just fine. And if that’s the case, there probably should be a way to avoid creating and storing such data on user’s device. Sorry if I’ve caused a misunderstanding about what I’m trying to achieve and thanks in advance for any suggestions and ideas 🙂 ---
**Author:** ![piperecorder](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/piperecorder/32/39652_2.png) [@piperecorder](https://forum.ghost.org/u/piperecorder)\ **Post date:** [February 20, 2026, 11:52am UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903/6 "2026-02-20T11:52:58Z")
For us, turning off **Member sources** under Ghost dashboard \> Settings \> Analytics disabled the `ghost-history` local storage key. It held a history of paths/URLs you visited on the blog. We’re on Ghost 5.130 . ---
**Author:** ![EchonCique](https://avatars.discourse-cdn.com/v4/letter/e/c4cdca/32.png) [@EchonCique](https://forum.ghost.org/u/EchonCique)\ **Post date:** [February 22, 2026, 5:32pm UTC](https://forum.ghost.org/t/gdpr-prevent-ghost-history-in-local-storage/36903/7 "2026-02-22T17:32:29Z")
> **[Cookies, the GDPR, and the ePrivacy Directive - GDPR.eu](https://gdpr.eu/cookies/)** > > Cookies can give businesses insight into their users’ online activity. Unforunately they are subject to both the GDPR and the ePrivacy Directive, making compliance difficult. When it comes to cookies and local storage of all kinds you must also ensure it’s compliant with the ePrivacy directive. It is the ”cookie law” and received it’s latest big revision back in 2009. I am also very grateful that Ghost in itself can be compliant with these regulations out of the box. The exact implementation depends on the laws in your country.