When a corporate lawyer hears a law explicitly list technologies like "IP addresses" and "cookies", they're going to (rationally) get scared when you step outside the clear boundaries of that law, and it's their job to place institutional pressure on technical people within the corporation not to do things that make them scared.