It's not just "a company", it's many companies. They're injecting this header into every request you make which is visible to the servers you connect to.

It makes any positive steps you've taken to protect your privacy utterly meaningless.