I think they meant that the use of cookies for analytics/tracking, which is what triggers the popup requirement, would have been considered malicious.