I doubt Organic Maps needs anything like this at all, All it needs is the country which can be inferred from the IP, it doesn’t need triangulation, cellular or utilize the permission to do so.
As they said, they don’t collect anything PII Period, if they didn’t update it then the Privacy Policy stays true, If they had anything to disclose they collect that we don’t know they would have to legally disclose it and if they’re in the legal right and didn’t change their methods, they just didn’t.
Contact them if you’re this concerned not us.
I think we should be more concerned about this than whenever organic maps collects Location data or not:
related PG Thread: