But you do give it permission. The data is only shared when you either install or open an application. Both things that you need to initiate. Nothing in the law requires that the data be sent off device. Ideally all of this checking would happen on device. And for those apps that don't meet that standard, don't use them.