Exercise 1: Why Third-Party Code Must Be Disclosed in the Privacy Nutrition Label — Possible Solution
===========================================================================================================

The Privacy Nutrition Label exists to give an actual, honest answer to
a real question a user cares about: what does installing this app do
with my data? That question is genuinely about the app's own real,
overall behavior on the device - not about who, specifically, wrote
each individual line of the code that produces that behavior.

A real third-party SDK - an analytics library, an ad framework, a
crash-reporting tool - runs as a genuine, integrated part of the
finished app once it's bundled in. If that SDK collects a user's
device identifier or tracks their behavior across other apps, that is
real data collection genuinely happening as a direct result of
installing this app, regardless of the fact that the developer
personally wrote none of that specific code.

If the Privacy Nutrition Label only had to reflect first-party code,
a developer could genuinely bundle in third-party tracking that
collects extensive real data while the label itself claimed the app
collects little or nothing - a real, misleading gap between what the
label says and what the app actually does. Requiring disclosure of
third-party practices closes that exact gap, keeping the label
honestly reflective of the app's real, total behavior as installed.

ANSWER: The label exists to honestly describe what the app, as a whole,
actually does with a user's data once installed - and third-party code
bundled into the app genuinely contributes to that real behavior just
as much as first-party code does. Excluding third-party practices
would let a developer's label understate real data collection simply
because someone else wrote the collecting code, defeating the label's
entire purpose.

WHY THIS WORKS AS AN ANSWER
------------------------------
This identifies the real purpose the label serves (an honest,
behavior-based disclosure, not a code-authorship credit) and explains
concretely what would go wrong if third-party code were exempt.