It's a little tricky to infer the specifics, but adware that collects personal data would be non-sensical if it doesn't phone home. In fact the whole idea of "

It's a little tricky to infer the specifics, but adware that collects personal data would be non-sensical if it doesn't phone home. In fact the whole idea of "collecting data" implies it is being sent to storage under control of the collecting entity. I think this is pretty clear cut under GDPR and there's no bypassing it based on the technicality of web app vs native app—I believe regulators learned their lesson about tight coupling to specific technical implementions with the earlier cookie laws. On the other hand, you could be write that OP is just talking about data portability in which case there is "data collection", just lack of an export feature.