Right to repair?

It's in that direction, but I think existing right to repair legislation stops short of the right to exclude dependency on the manufacturer's infrastructure entirely.

Or it could be done like GDPR — requiring consent and explaining what addresses the device will communicate to, what data will be sent, when, and for what purpose. GDPR requires that every purpose of personal data use is consented to and explained the same way — what data is collected, where it is processed, for how long it is retained, and for what purpose. New tech privacy laws could* definitely use something like this as a starting point.

* Assuming no malicious lobbying.

> - turn off the phoning home without breaking local functionality

Start with Windows, iOS (Siri), and pretty much any updateable software.

There's updatable software that only updates when you tell it, and only to the version you tell it to, but it's certainly not the norm.

Let's change that. Anything less is a RCE vulnerability.