opt-in must be explicit, cannot send tracking cookies beforehand
not only lame but illegal
Nobody's going to sue us for it, right?
The recently notified AEPD AJ Santiago, my client, which begins disciplinary proceedings against a company that does not meet the Cookies Act. The penalty for breach mild (art. 38.4.g LSSI) Act Cookies (art. 22.2 LSSI) is up 30,000 (39.1.c art LSSI). The penalty could be up to 150,000 € (Art. 39.b LSSI) if the breach was significant (art. 38.3.i LSSI), but not the case.
(yes, this is Google Translate)
TL;DR don't send tracking cookies without explicit consent