deny is the default

Article 6 and 7 of the GDPR

respect DO NOT TRACK, and force software/hardware providers to enable it by default

There is other software and other areas of human activity than just cookies and browsers.

Also, with "deny is default" you shouldn't really nead the DNT. But tell that to the ad/tracking industry

making payments for non-tracking illegal

Generally derived from GDPR. See e.g. recital 43 https://gdpr-info.eu/recitals/no-43/

remove or rephrase "legitimate interest" ruling, because providers use that as an excuse to enable everything

It's there because actual legitimate activities like security audits or fraud detection would not be possible.

EU expects companies to act as adults, but here we are.

prohibit any other dark pattern, or at least make it extremely hard to implement

This cannot be properly specified. And existing laws and regulations already cover that.

See the article we're commenting under. And noyb's previous cases: https://noyb.eu/en/where-did-all-reject-buttons-come