And if you’re serving those pop-ups from US-controlled servers (even if they’re in the EU), you’re violating the Schrems II ruling.