Update: I got it approved now. As I mentioned before, I re-submitted a new binary which was basically just a build number bump. I commented both as a reply to the first review and in that field we can use to communicate things to the reviewer of a new submission that I had the IAPs approved before - and included a screenshot of the IAP screen showing that. It worked this time.

Just had this problem too. IAPs were already approved in a prior (submitted) version of my app. I have just re-submitted a new build (same thing, just bumped build number) and attached a message (and picture) showing that IAPs were already approved. Let's see.

If at some point the user had to consent to GDPR, then you could save that fact in local persistence (e.g., SharedPreferences/UserDefaults). Something like a isEEA flag. And then you'd only show related widgets to revoke/edit consent when that's true.