From a legal perspective, if you track enough information to indirectly identify a user, it falls under GDPR. That we agree on. Is location and device type enough? I would say it could be argued Yes. My target audience is Lawyers (I am a former lawyer) so I have to be very very careful with how the user interprets.
At the end of the day, we know there is no binary answer. It is not a yes or no. It is about a level of interpretation. For my use and audience, I have to be over the top cautious. For others, they can probably argue a much looser interpretation.
So we are all right