Scummier tactics are still used. The tracking and surveillance density of a typical iOS app – including screen recording – is shocking.
Screen recording sounds suspicous and even illegal in some jurisdictions. For example, if an app records my screen while I get an incoming iMessage, I can easily argue that being a GDPR violation.
"In an email, an Apple spokesperson said: “Protecting user privacy is paramount in the Apple ecosystem. Our App Store Review Guidelines require that apps request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity.”
“We have notified the developers that are in violation of these strict privacy terms and guidelines, and will take immediate action if necessary,” the spokesperson added.
https://techcrunch.com/2019/02/07/apple-glassbox-apps/
In my opinion, unauthorized processing of email addresses or credit cards or other personal information is also a clear violation of the GDPR in the EU. Of course there might be shady companies who willingly tries to break the law, but that is business as usual for law enforcement.
Same for websites. It makes sense for development, however, it remains turned on in most apps. And at least under iOS, there is no actual ad / tracking blocking available for, well, against apps.