There is no harm in asking things like what do they expect to get out of it, is it possible to achieve the same result with a privacy-first alternative, can it be recorded on your backend with no need to fingerprint the user etc.

“The boss” often doesn’t know or care about the implication of involving data brokers. We’re not just code monkeys.