session_start() initializes or resumes a session, storing data server-side and referencing it via a session ID cookie sent to the client. $_SESSION is used to read and write session data during the request lifecycle.
Cookies, set with setcookie(), store small pieces of data client-side; sensitive data should never be stored directly in cookies without encryption, and secure/HttpOnly flags should be set to reduce attack surface.