It depends on what you consider spying. The vast majority of devices want some form of push notification capability, which requires being connected to Microsoft/Google/Apple servers, and thus the company knows your IP address. But doing pretty much anything on the internet and you expose your IP address.
If what you mean by spying you think it is looking at what app/program you are doing, recording your keystrokes, recording what your camera sees, the vast majority of devices don’t do any of this. Those are done on hacked laptops and school laptop admins that are either creepy and unchecked or overly intrusive.
Somewhere between these two extremes you would say it crosses the boundary into spying. You don’t need a custom OS to stop it unless you your threshold is all the way to the push notification level.
Is this new law allowing the police to go to carrier companies and demanding to know the phone numbers of people near the riots, or is this closer to the police using your camera without your permission? I would have thought security restrictions on devices would have blocked such intrusive ability.