My response is similar, usually the good old ‘Do you shut the door when you shit?’.

When we start getting specific, I’ll often try and frame data harvesting in a much more visceral way. If they say they don’t care that xyz keeps track of everyone they talk to, I ask them to imagine an actual person standing behind them, making notes on a clipboard about every interaction they have with someone, and how that would make them feel.

My understanding is that cookies were generally just used as a fingerprint- it’s just a unique ID that is used to tie your device to their database, which is where the information is kept.