The issue is imho that the decision needs to happen server-side (so that a user with an incompatible client isn't slurped up by default), ergo the user-agent must declare the intentions of the user and the server needs to act on it.

P3P could be a hint for the the user-agent, but the user-agent would have to tell the server what level of tracking etc is acceptable to the user.