This standard only covers advertisers and analyses, so it wont do any good against malware.
I've read the drafts and so far the system is based primarily on trust between the user and a given site. Here's how it works.
- The user enables Do Not Track and enters a site.
- The browser then tells the server that you do not want to be tracked.
- The server then responds if it intends to honor that or not. It can also start a negotiation process, to make you change your mind.
The site can decide to deny you access until you add them to an exceptions list, log in or whatever.
The document describing compliance and enforcement is still very much a draft and doesn't contain much information so far. However it does say that if DNT is enabled then the site should delete all the info they have on you. The way i interpret that, it also includes that they should delete any cookies they have on your computer.
It only gives suggestions as to how this can be enforced so that sites don't just ignore it, the words "public statements" and "external audits" does come up though.
Hope that made any sense