4.0 P3P Implications
The P3P policy identifies collected data, purpose of collection, and recipients of the data. These are the three key elements in evaluating what will happen to a cookie that is delivered to a client. Cookies are not bad things, however, the perception that something about them is bad is a very persuasive privacy argument. Since users see them as a privacy concern, browser agents identify them as a privacy concern. It is like being tracked by a private eye. The cookie identifies you every time you go to the site that set the cookie. Couple that with the garbage collected such as the pages you visit, the items you buy, and the search terms you enter and it paints a very good picture of who you are what you want. It is for this reason that the browser will limit the cookie depending on what the web site will do with the data collected and who they will give the data to.

The cookies are delivered in the web page header and compared to the information contained in the privacy policy (compact policy). The browser then compares the two to determine action to take regarding the cookie and the information it contains.

4.1 IE6 Cookie Actions
IE6 takes action based on the cookie context and on the content of its compact policy. The browser will take action to accept, deny, downgrade, or leash the cookie.
  Deny - the cookie is not sent.
  Downgraded - a persistent cookie that is deleted when the browsing session ends or it expires.
  Leashed - it is only sent on requests to download first-party content (they are not sent for third-party content).

4.2 IE6 Unsatisfactory Cookies
An unsatisfactory cookie is one that contains or allows access to personally identifiable information and is used for unstated purposes or unstated recipients without user consent.

Personally Identifiable Information is 1) physical contact or location information, 2) online contact or location information, 3) government issued identifier, or 4) information about an individual's finances.

When the compact policy shows that personally identifiable information is collected then the cookie will be unsatisfactory for the following purposes and recipients unless you offer the user a chance to opt-in or opt-out.

A server without a compact policy that delivers a web page with cookies automatically has an unsatisfactory cookie. Note this is contrary to the P3P specification that says that the browser should get the full privacy policy if there is no compact policy.