IF they can tell the difference. IF they can see that the header is from a different game. Can they? Maybe, maybe not. We don't know and nobody can say with 100% confidence one way or another. I have a feeling that CIAs will be next, and others have a feeling that private headers will be. But nobody has any solid facts. Nobody who uses either card is safe. Hell, people who use R4 cards aren't completely safe. You know what would be 100% safe that we can all agree on?
Have a 3DS and put all the pirated game you want on it and play online until your hearts content using private headers or CIA. If you don't get banned YAY. If you do, buy another 3DS and play retail online games on it, and keep pirating away with the offline ones. Yeah it's more expensive but you're not going to get banned from playing retail games on an unhacked 3DS.