App Store Rejection for Device Fingerprinting

In regards to Apple Developer Program License Agreement, section 3.3.9, it says that the app

may not collect user or device data without prior user consent ...

I would like to clarify whether or not this is only applicable for advertising purpose or applies to all of the apps submitted to App Store.

I use similar techniques for security purpose as part of the authentication journey in the mobile application to collect some information like device model, OS version, locale, timezone, location information and etc, but not IDFA. And I do not generate a unique identifier based on the collected information, and just generate the identifier based on my own logic (combined with device vendor identifier). Of course, with all the information that I'm collecting, I adhere the privacy consent setting as per those APIs requirement (such as location, or BLE usage).

I am not sure whether this section 3.3.9 was newly introduced as part of Apple's effort to increase security of user information that will be released in the next iOS version (together with IDFA). But would like to see if such activity that I'm doing would also be flagged and will eventually be rejected.

Any thoughts?

In addition to the original question, if this is applicable to all apps collecting device hardware / software information for risk analysis or any other purpose, what form of user consent is required?

Of course, all the privacy consent as per APIs requirement (in info.plist) would be implemented, but what additional consent would satisfy the Apple's requirement? Would informing the users through terms and condition or privacy policy be acceptable? or is it required an explicit consent from the end-user for collecting such information?
App Store Rejection for Device Fingerprinting
 
 
Q