I think they might be referring to the dark pattern where there are two sets of "Legitimate Purposes": 1. Actual legitimate purposes for core functionality 2.

I think they might be referring to the dark pattern where there are two sets of "Legitimate Purposes": 1. Actual legitimate purposes for core functionality 2. A toggleable "legitimate purposes" under the ads section Presenting the second option could be construed as malicious compliance or just dishonesty. On sites where I've seen this, there is no one-click option to disable those, which should make them non-compliant with GDPR.