For our project, we created a fictional cookie company called Cookies Ltd. and passed out cookies on the main green. However, in order for customers to get the cookies, they had to provide us with things -standard corporate stuff like filling out surveys, giving personal information and "Liking" us on Facebook, but also providing us with fingerprints and hair and blood samples. We claimed this was because we wanted to "gather information about our customers in order to better understand our userbase so that we can better tailor our cookies to the community". We did this not so much to 'see how far people would go to get cookies', as some guessed, to mock the corporate New Media culture that fetishizes collecting intrusively personal information and running complex statistical analyses on them, regardless of how useful it is. We took this to an extreme, where hair and blood samples are both creepily intrusive and utterly useless to making and selling cookies.
We also tried to push the analogy with internet cookies. One of the options we had to get cookies was for people to sign a form, which in fact was an adapted internet-cookies policy, in which we claimed that the cookies were tracking devices that would be "stored in users' stomachs". We gave people "customer ID numbers", similar to the ID's assigned by cookies, and made them take some permanent representation of this, either on a slip of paper or by writing it on their hand.
On the second day of giving out cookies, there was coincidentally another stand set up in Faunce arch where people were giving away flavored seltzer water in exchange for signing up for (and giving their personal information to) a used textbook services.