[jgtrosh]

5) seems scary to me. Isn't that something you would need the user to opt in to? Or does EDPR not apply to apps?

[fiiv]

GDPR does not prohibit tracking. GDPR prohibits not disclosing that you're doing it (and naming 3rd parties that you use).

I like to look at it as a rethink moment for when you build in the mechanism to track. Do I really need this? Is there data I don't need to collect here? Do I need a user's consent?