Who's selling the data is the far more serious issue here. Behind this is a remarkably well-structured syndicate. The supply chain looks something like this: consumer apps embed ad SDKs → those SDKs feed location signals into RTB ad exchanges → surveillance-oriented firms sit in the RTB pipeline and harvest bid request data even without winning auctions → that data flows to aggregators who don't have any direct relat…
There probably was a consent, buried on page 12 in the terms of use of the app they installed at the front of your chain.
Even the "reasonable person" standard for court would probably conclude that most people would never read it.