It only works when the majority of good actors adopt it as a standard. Effectively an agreement to abide by it. Or, as the article notes, it's enforced as a part of policy. In Europe it's being pitched as a method to help assure GDPR compliance. Of course that likely falls apart if what would be good actors don't agree to utilize or adhere to the standard. It probably needs to be picked up as a W3C standard or something to see broad use.