Apple’s specific policy site is good to read over ... https://developer.apple.com/app-store/user-privacy-and-data-use/
Defines the use of ATT as well as the user of tracking cases.
Apple claims that you can’t use email address to track a user - Begs the question of enforceability.
Information can be collected for real purposes that aren’t tracking. Once that data is server side, no way for Apple to enforce collection and usage. This means backend data unification could play a major role in bending the rules.