Yeah, what gjb
said. I've also found that bringing to light the legal implications of such a project can have some impact. I mean, how would your boss feel if it was their project that blocked the whole company from a crucial website, or brought a lawsuit (especially if they knew it was a possiblity). IANAL, but they seem to scare people pretty well when they know what they're doing is wrong. And as always, documentation is key. Your warnings in email can be a nice way to cover your back if/when the company looks for a scapegoat.