An American thermostat would be using around 920MHz which is the equivalent unlicensed band in the US. Funnily enough, the author warns Americans as an example

An American thermostat would be using around 920MHz which is the equivalent unlicensed band in the US. Funnily enough, the author warns Americans as an example but he is running more foul of the local rules an American would be (assuming an American would use 920MHz and not 868MHz). In the US you are allowed to tinker around there with home-built RF devices for personal use and prototyping in unlicensed bands, to some extent. Although, using an SDR for this requires a certain interpretation of the rules. In Europe it's basically not allowed, one shall only use pre-certified modules. Or only use the device you've built in an RF anechoic chamber until you've undertaken the certification process (totally impractical for a hobbyist).