Confirmed
Google's John Mueller Says Blocking A Popup's Script Or Domain In robots.txt Generally Works
Replying on Reddit's r/TechSEO about an age-verification popup, Google's John Mueller said blocking it through robots.txt would generally work. He named two routes. The popup's own domain can disallow crawling, so Googlebot skips those URLs while rendering. Or the site can disallow the one script file that loads it, which he advised against if that file does many other jobs. Pages must still load without those resources.
In plain termsRobots.txt is a file telling crawlers which URLs not to fetch, so if the popup's code sits at a blocked address, Googlebot never loads it and never sees the popup covering the page.
Why it mattersA popup that hides content from Googlebot can be handled in robots.txt, but disallowing a shared JavaScript file can break rendering for everything else that file does.
Our takeThe safe reading is narrow: this fits a self-contained script that only draws a popup. Any file that also carries navigation, content or product data is the wrong thing to disallow, and a rendering test should confirm it first.