Cookie policy distinguishes between first-party and third-party cookies

GDPR Art. 13(1)(e) requires disclosure of recipients or categories of recipients — which maps directly onto the first-party/third-party distinction in cookie usage. When third-party cookies are listed alongside first-party cookies in an undifferentiated table, users cannot assess the cross-site tracking implications. Third-party cookies set by Google or Meta persist across every site where those providers' scripts run; first-party cookies are domain-scoped. ePrivacy Art. 5(3) consent must be informed about this distinction because the scope of data access differs materially. CCPA §1798.135 similarly requires disclosure of whether personal information is 'sold or shared' with third parties — a concept that maps directly onto third-party cookie tracking.

Split the cookie policy table into two sections using the thirdParty field from COOKIE_REGISTRY. Add explanatory prose about what third-party tracking means for cross-site data collection.

// app/cookies/page.tsx — two-section layout
<section>
  <h2>First-Party Cookies</h2>
  <p>Set directly by {siteHostname}. Not shared with other domains.</p>
  {/* COOKIE_REGISTRY.filter(c => !c.thirdParty) */}
</section>

<section>
  <h2>Third-Party Cookies</h2>
  <p>
    Set by external services loaded on our pages. These providers may also
    collect data on other sites where their scripts run. Each provider is
    subject to its own privacy policy.
  </p>
  {/* COOKIE_REGISTRY.filter(c => c.thirdParty), include provider + privacyPolicyUrl column */}
</section>

Filter COOKIE_REGISTRY by thirdParty: true | false and render the provider's privacy policy URL as a link in the third-party table.