Well the thing is, it’s really hard to define what “spyware” is from a legal sense. For example anti-malware software is highly invasive by definition.

It seems the real problem is consent… There should be a “nutrition facts” for software that is enforced at the OS level through an aggressive permissions model and backed by a privately run app stores subject to audit by government regulators.