"consumers should be able to turn off unwanted data transfers"
No, no, no!!
Consumers should be able to turn *ON* unwanted data transfers. Explicitly. After being forced to change the default password, and after having to re-enter the new password to accept the data transfer.