Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate business reason under GDPR, e.g. TomTom:
EU Data Protection legislation states that companies are only allowed to record and keep personally identifiable information (such as GPS tracks and traces linked to a particular device) if there is a valid business reason for doing this. Since TomTom does not have such a business reason, we have made sure that our data processing operation does not maintain information regarding user-, or device locations in identifiable form. That means we cannot track a specific user or a specific device.
How is tracking a stolen GPS different from tracking a stolen phone?