However, I have also suggested to clients that they put a line in their T&Cs / Privacy Statement that just expands on this a little bit to cover their backs.
Some 'nervous' clients have opted to put the following in brackets after the Remember Me text.
(this will store your login details in a cookie on your computer)
The biggest grey area for me is actually Google Analytics (other analytics packages are available). My concern here is does the user now need to opt in to allowing analytic information to be captured? Does the responsibility of this lie with Google or with the owner of the website?