[ComodoHacker]

And if a browser or extension abuses these signals (i.e. always sends them without user's explicit and informed consent), who is liable?

[majewsky]

Liable for what? GDPR says you can only collect data if you have informed consent from the user. It does not imply any right on the side of the business to be able to obtain such consent.