Even data collected with proper consent has limits: it can only be used for the purpose disclosed at collection time, and third-party data brokers, ad networks, or data-selling arrangements need explicit disclosure.
Often triggered by an SDK (analytics, ads) sending more data off-device than the app's own privacy policy discloses, which reviewers can catch via network traffic inspection.
"Your app collects user or device data without prior user consent, or shares data with a third party in a way not disclosed in your privacy policy."