Ironically, the do not track setting itself can be used in browser fingerprinting.

In fact, it is _primarily_ used as a point of entropy for tracking, and does almost nothing to prevent tracking, so all-in-all it's a huge net negative. And because it's mostly turned off, turning it on to be tracked less actually causes you to be tracked more.

Exactly, this is why it needs the force of law behind it.

With robust enforcement. Otherwise it's a technical cat and mouse game, and few large players are on the users' side.

EDIT: typo