The latter at least would lead to App Store rejection.
Every time you submit an update to the app store for review you have to check a box that says that you acknowledge that you are using the advertising identifier in some capacity in your app, and another that says that you are faithfully abiding by the user's "limit tracking" iOS setting. If they catch you lying about these things they say they will remove and ban your app (no future updates either) from the store.
Why?
I think the random id would be preferable from a user pov. But this may represent Apple's attempt to play nice with mobile ad companies and app pubs that rely on ads in at least making it easy for them to identify no-track users. (Then again, they could accomplish that in a more direct way by just having a flag here, which they may also do?)
Also Apple's guidelines re: permissions is that the app must degrade in the absence of permissions gracefully, and any kind of "punishing the user" for denying perms is absolutely prohibited.
For all the bad things about the walled garden, this is one perk that is real.
As for Apple walking back on these things - anything is possible, but considering how hard they've been beating on the user privacy drum I doubt this will change in the foreseeable future
IMO the "zero" ID is preferable to a random ID. This way if anyone has legitimate reason to detect for this condition they can, but Apple has enough control over the platform to ban anyone doing so abusively. It's also more in line with Apple's permission systems (e.g., you can detect if you have Contacts permissions, rather than it returning, say, fake/empty contacts).
And to be more specific on my question, I get that they don't allow apps to punish users explicitly for OS-enabled choices. But what about rewarding users? Ie you can play/use the app however you want. But we'll give you 50 coins/10 loyalty points/whatever if you enable location tracking?
I mean to follow this all the way through... it should mean that apps can't choose to show, say, rewarded video ads (presently a $1B+ revenue/yr industry on iOS) only to users who have do not restrict ad tracking. Because then by definition only users who don't restrict ad tracking could get the reward from viewing the video. Will this be the case? It's an important question and a lot of startup value could be effected depending on the answer.
AFAIK incentivizing permissions is allowed, so yeah, "50 coins for your location" is permissible. Though keep in mind that Apple will reject apps for requesting permissions without any functional need - so if your app isn't actually using the location data (and collecting it purely for ad targeting) it's likely your app will be rejected from the store.
You will have to invent some veneer of an excuse for collecting this user data, though how thin your excuse can be varies depending on Apple's mood.