It's turtles all the way down.
The only legit solution is the government, because they are the only ones without a profit motive in the whole system (although they can be bribed, but that's a whole other can of worms).
Which government? I mean, I'm certainly not going to be very impressed if the (for example) US government releases a statement saying "Yeah guys, app Foo is totally legit and doesn't track you or leak any of your private information".
LOL. As you even parenthetically recognize, government doesn't magically solve humanity's capacity for wickedness.
The true "legit" solution is institutional legitimacy, which is fundamentally founded in a devotion to rational integrity. Genuine legitimacy can only be earned by sustained integrity, its not minted with the legislator's pen.
I agree that you're right to be concerned with the bad incentives of pay for play, but you appear to be missing the unintended consequences of imposing a regulatory monopoly.
We’re working on a way to make that data accessible to app developers so they can learn from competitors, but having a simple way to tell if an app tracks you that doesn’t require signing up or anything like that could be an interesting idea.
Would you actually check an app before downloading/using it?
I would definitely appreciate it if there was a service that allows me to quickly check if an app is safe.
https://reports.exodus-privacy.eu.org/en
It is also build into the Aurora Store (alternative Google Play Store client for Android).
For developers, additional traffic becomes an incentive to comply.
Or someone posted a meme with the seal in it on Facebook.
For websites, agreed google would have to display it or it'd have to be after the initial page load which means you'd be tracked the first time you visited the site and you'd know not to visit a second time.
Perhaps for websites, a browser add-on that checked a certified ad tracking free database registry could be used.
Maybe an existing organization in this space such as the eff.org with name recognization could come up with a certification methodology and branding seal for websites and apps.
[1] https://en.wikipedia.org/wiki/Motion_Picture_Association_of_...
2) Donate to Marcel for key to get granularity
3) Turn off ALL apps, so when they launch they have no wan access.
4) Open each app one by one, noting what links and phoning home the app tries to perform
5) Watch in disgust as you begin to realize all of your efforts to secure your privacy up to this point has been in vain...antacids help.
6) Take control by granularly killing the links/calls in apps you decide to keep. Spotify calls FB, but you now can fix that. This is empowering but only a start.
R/privacy will make you paranoid, but a good place to get an idea what you are up against. I read Anon, join to post, and after some time delete my content, been doing that for decades now.
1: https://reports.exodus-privacy.eu.org/en/reports/us.zoom.vid...
2: https://f-droid.org/en/packages/com.oF2pks.classyshark3xodus...