Point 1 means that e.g. the GDPR doesn't mandate a specific implementation. It describes the outcome, which is quite reasonable.

Point 2: you can't check/verify if parties, especially those outside the jurisdiction of the EU, really honor things like the 'don't track' flag.

It's unfortunate that so many companies decide to implement the requirements in the laziest and sleaziest possible ways.