Then return an error when requests with the DNT header are made. You can't expect people to magically know ahead of time that your website is being used to spy on them.