We're facing the same issue. Not tracking users, but being rejected for not popping the ATT. They specifically keep referring to the fact that we're requesting explicit permissions for GDPR purposes in Europe, but that is a completely different policy, unrelated to tracking. What I don't understanding is why we need to waste such enormous energies explaining to reviewers what their own APIs purpose is, they're essentially asking us to misuse their ATT API and confuse users. We're not going to tell our users that we track them when we do not (because it not only be misleading our users but also contradicting our privacy policy), so our only alternative is to strip analytics from the app entirely which would be so totally counter-productive for both our own progress and Apple AppStore quality.