Wouldn't it be better to mandate that sites honor the Do Not Track* HTTP header, rather than require each site to explicitly seek user consent?
Where it is technically possible and effective,
in accordance with the relevant provisions of
Directive 95/46/EC, the user’s consent to
processing may be expressed by using the
appropriate settings of a browser or other
application.
That's true, but only (or at least, partly) because the sites can just ignore the header. If this became a standard HTTP hear and there was a requirement for it to be respected, browsers will quickly start supporting it.
>and it's not the default policy in any, AFAIK. It'd hardly have the same effect.
That's the whole point. It would still allow for analytics to be collected and made use of to improve web experience, while giving concerned users an easy way to opt out without being constantly hassled with "Will you allow us to track you?" question from each and every site they visit.