How is this legal under the GPDR? There is clear examples in the citizenlab document of a user been tracked inside of the EU from outside. Is there not also a

How is this legal under the GPDR? There is clear examples in the citizenlab document of a user been tracked inside of the EU from outside. Is there not also a requirement for clean consent? Ie a weather app can’t track your precise location?