I’d have to read this specific decision but my opinion is that while the GDPR says the user can refuse consent “by automated means” it doesn’t specify what those means are, thus making it quite hard to follow, enforce and therefore likely that other courts will decide differently on similar cases. E.g. would my own “X-Tracking-Is-Stupid: don’t track me” header be valid as refusing consent? What if I add it as a query parameter in the URL? And so on - DNT is not special in the eyes of the law.