There are a few practical issues to solve first. Rules must apply over time. A "turn everything off" request shouldn't be able to transform into "except these

There are a few practical issues to solve first. Rules must apply over time. A "turn everything off" request shouldn't be able to transform into "except these new on-by-default features added in patch 1.01". Software has bugs, including "off switches"; as such, even if there appears to be a way to shut everything off, I always assume that these may fail. The "over time" problem applies here, too; a year from now, some poor new guy tasked with maintaining these protection switches might screw up an update and break an off-switch that used to work fine. Information is currently too valuable. As a society we really have to get to the point where the value of bits of data is so low that leaks don't matter. We sure as heck shouldn't have ways for criminals to screw you by knowing a single number that belongs to you! Information is inherently hard to protect. Photos are very hard to protect; even if you had a new file format, encryption, low-level hardware that was physically incapable of accessing pixels without a key, memory that could not cache plain-data versions of the image, etc. there is still an easy way for someone to take out an iPhone and snap a copy of what they see on their screen and keep it forever. True photo security would practically require what is mandated for photocopiers with respect to counterfeiting; all cameras and all displays would have to be equally mandated to use watermarked images that encode encryption keys (e.g. your camera can only take a picture of another image if the associated key is one that has granted you access). And of course, that level of assurance could also be abused. Ideally the average citizen would be able to grant and revoke keys for any and all organizations like Facebook or Microsoft, and systems and formats would be such that information is impossible to use once a key expires or has been revoked.