The GDPR is going in the right direction by creating a "bill of rights" for your data, so ownership is firmly delineated and all 3rd party use of data revolves

The GDPR is going in the right direction by creating a "bill of rights" for your data, so ownership is firmly delineated and all 3rd party use of data revolves around clear revokable granular consent. What we need now is a "bill of rights" defining and preserving the notion of ownership for digital devices. Part of that should be that the device should only do what it's explicitly asked to do. Updates should be opt-in in nearly all cases, and mandatory updates should meet stringent requirements similar to vaccines. That is, only to combat major threats that apply to users as a group.