I am eagerly awaiting your grassroots campaign to define legislation that would tackle such uses, and also eagerly awaiting it backfiring because of malicious compliance.
Malicious compliance is a result of incompetent drafting. It's common because incompetent drafting is common, case in point GDPR. It's definitely possible to screw it up less than that -- there are many laws that nobody complains about.
You pass a law prohibiting any entity from conditioning the use of their service on the user providing them with a phone number. Even services that actually use SMS or voice calls are required to provide an alternative like email or the web with no reduction in functionality and for no additional cost.
You pass a law stating that any device which is sold or leased to anyone who takes physical possession of it cannot contain a private key the customer is unable to both read and extricate at no cost.
What does malicious compliance look like there? Anyone can give them an email instead of a phone number and if that doesn't work they're in violation. Remote attestation is the only reason for devices to come from the factory containing an inaccessible private key, which is thereby prohibited and unable to be used as a tracking ID.
> Malicious compliance is a result of incompetent drafting
Aha ok, so your judgement of an entire governmental apparatus, trying to influence and predict millions of people in hundreds of thousands of companies and across hundreds of industries, from the most sensitive to the most frivolous of activities, can be summarized in a one liner.
Don't you think these people got advice from people like you? Do you think you are smarter than whatever panel of experts was involved? Do you think maybe the panel of experts was confronted with some information that you do not have? Do you think maybe something you value was in conflict with something somebody else values?
I really cannot express how unlikely it is that you are right.
You pass a law prohibiting any entity from conditioning the use of their service on the user providing them with a phone number. Even services that actually use SMS or voice calls are required to provide an alternative like email or the web with no reduction in functionality and for no additional cost.
You pass a law stating that any device which is sold or leased to anyone who takes physical possession of it cannot contain a private key the customer is unable to both read and extricate at no cost.
What does malicious compliance look like there? Anyone can give them an email instead of a phone number and if that doesn't work they're in violation. Remote attestation is the only reason for devices to come from the factory containing an inaccessible private key, which is thereby prohibited and unable to be used as a tracking ID.