[koluna]

You opt in when you choose to buy a piece of hardware from a vendor, and when you sign up for a carrier. Apple needs to identify phones that are flagged as stolen. They also need to connect the user to the carrier through their software and hardware, which means they must have a level of visibility as to who the user is.

[morsch]

Not sure (IANAL) if buying a piece of hardware constitutes "freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her" (GDPR).

"Consent means giving people genuine choice and control over how you use their data. If the individual has no real choice, consent is not freely given and it will be invalid." and "This means people must be able to refuse consent without detriment, and must be able to withdraw consent easily at any time. It also means consent should be unbundled from other terms and conditions (including giving separate granular consent options for different types of processing) wherever possible." (ICO commentary)

Of course, this only applies wherever the GDPR applies.

https://ico.org.uk/for-organisations/guide-to-data-protectio...

[Aloisius]

Legitimate interest, not consent.

Organizations can have a legitimate interest to process data in order to provide a user with the data service they signed up for.