I would think that this kind of data collection is already illegal, at least with installs in the EU. GDPR mandates that the collected data is either directly r

I would think that this kind of data collection is already illegal, at least with installs in the EU. GDPR mandates that the collected data is either directly required to render the desired service or explicit and revokable consent must be given. Clearly neither is the case here.