One thing I don't get is how a site-owner is meant to know what cookies a 3rd party may send. If I add a Facebook "like" button to my site, does FB send a cookie? What if they don't now but decide to later. And if FB does decide to use cookies down the line, how do they ask your opt-in?

You can send cookies with any HTTP reply, so how do you know if that image you are hot-linking from a 3rd party site doesn't send back a cookie?

There seem to be so many technical vagaries that make this so tricky to implement properly.