The Spanish Data Protection Authority announced it imposed a sanction on an organization for installing cookies on a device without obtaining prior consent of the user.
https://www.aepd.es/resoluciones/PS-00127-2019_ORI.pdf
[protecting people by good design, solid security, efficient processes and trusted services]