> I don't know how I'd go about codifying that into law though.
Simply make the DNT-Header a legally binding thing. If the user sends it, it means that only technically necessary cookies can be used.
This would require no UX from the side of the website, thus defeating all dark patterns at once