While others are focusing on the legal aspect, which I guess is the question you actually asked, my first thought was bare minimum compliance while gathering evidence. Grab an old phone, wipe it completely, install the app with all new credentials not tied to you in any way, then just leave it running at work. They get their location data, just not anything usable, you get to submit a minimum number of receipts that doesn’t get you in trouble from purchases you would have made anyway, or not because why support scumbag companies. You get to gather more hard evidence of their assholery that way. Never install work apps on your personal phone. If they require something for your job, they should provide the hardware to run it on.
While others are focusing on the legal aspect, which I guess is the question you actually asked, my first thought was bare minimum compliance while gathering evidence. Grab an old phone, wipe it completely, install the app with all new credentials not tied to you in any way, then just leave it running at work. They get their location data, just not anything usable, you get to submit a minimum number of receipts that doesn’t get you in trouble from purchases you would have made anyway, or not because why support scumbag companies. You get to gather more hard evidence of their assholery that way. Never install work apps on your personal phone. If they require something for your job, they should provide the hardware to run it on.