Not all resources are HTML so I couldn't use the meta tag, but the header looks interesting! Reading up on it, it seems to achieve pretty much the same thing as my current solution. Would you say this is better for some reason? Nobody should encounter my server's 403 response except those with a Google user agent anyway.

The page doesn't say whether this works the same as the robots.txt disallow, where you may still appear in results because other pages link to you. The 403 might be more effective, but I can't really tell either way.

great point, but at that point you have to trust google with your data.

and if you are taking this action in protest, you probably don't.

if you don't serve the data at all, whether or not to respect your "noindex" is imposed on google, rather than being a suggestion (like "do not track" in the chrome browser; we all know how that turned out)