TL;DR
Both are crap and don’t respect your choice when opting out.
iOs is even (a tiny bit) worse than Android, as info of nearby devices are being also sent.
Following the adoption of the Data Privacy Framework, US authorities provide a list of self-certified US companies.
This means a list of companies that are not UP the GDPR standard, and use this framework as a workaround.
It’s possible, I’ve been tricked last year by a similar attack (the sneakiest attack possible to target privacy people, imho).
I praise IT Security for putting so many safeguards, sandboxes and verifications!