I'm wondering if is ok to apply it to a privacy pop up page, to prevent it from getting spidered and from pr going into it. I've used no follow, no index and it's still gotten indexed so I'm hoping that it will at least prevent that.
If we are not allowed to do that, what is the best way to handle a privacy page that you don't want pr sent into? Assuming there was no way, what's the best thing to do? Should I make the privacy page (a popup) link back to the absolute url so at least any pr gets sent back to the site and its not dangling?
nofollow only stops that link being valued (in theory) when followed. it doesnt stop it being followed or the target page being indexed anyway. Try adding a robots exclusion tag to that page. Its not guaranteed to stop the bots getting there and indexing, but it generally will. If it is already in the index there is a remove url page somewhere on google.