> all this in-app tracking must be a violation of the GDPR, no?

Probably, but we're gonna have to wait for the courts to weigh in for a definitive answer.

Same with the very popular pay-or-accept-tracking model. An Austrian court found it illegal, but we'll probably have to wait for a case to make it all the way to the ECJ.