Yup. In some cases it's not actually the app doing this either. That is to say, the devs at Yoyodyne Inc, who wrote the functionality you're actually paying for

Yup. In some cases it's not actually the app doing this either. That is to say, the devs at Yoyodyne Inc, who wrote the functionality you're actually paying for, also had to include some third-party SDKs for ads or SSO or analytics or whatever as part of the business requirements. And this is the problem: that SDK has all the same permissions as the code that the devs can see and audit. Even if the app isn't explicitly passing info into the SDK for tracking, the SDK can do whatever the heck it wants. (And there are sneaky workarounds like IP-based geolocation, which isn't perfect but also can't be easily stopped.) This is not to absolve the company that incorporated the SDK of responsibility; but it's also worth noting that in a lot of cases they're probably not doing it deliberately, aren't benefiting directly, and may not even know that it's happening. We, as iOS developers selling an app to our users, absolutely should know, but don't always. This is something that I think engineers should be pushing back on the business side whenever we can. These leaks that we open up aren't worth the gain. I would love it if Apple came up with a way to expand their extension model and let us easily sequester third-party code. We'll see if something like that develops.