The legislators haven't legislated for a particular mechanism, they've just said that any tracking has to be opt in, as opposed to opt out. Do Not Track was a technical solution for this, but when IE made do not track the default, and tracking something you had to opt in to, they panicked and stopped supporting the headers and instead preferring the cookie walls, rather than trusting the browser settings. If websites respected UA settings, and the UA implemented DNT in a way that's compatible with the law (so, DNT: 0 only when you opt in), then we wouldn't be here