The only way this could possibly be true is if you're like a desktop software publisher. Server-side state that relates to human activity in any way is "something shady" and illegal by default.