Having read the article, I'm guessing you're meant to fingerprint your visitors and then exploit their identity somehow. That's what counts as "breaking" the API.