The problem here is that the main audience impacted by these "permissions prompts" has zero idea whether what the site is requesting makes any sense. You - as

The problem here is that the main audience impacted by these "permissions prompts" has zero idea whether what the site is requesting makes any sense. You - as a developer - probably know that an image editing site might need this permission and other sites don't. The average user has zero (ZERO) clue. They don't know, they don't really care. Instead they arbitrarily accept or deny based on how scary the popup text is, or how annoying it becomes, or how much they depend on the site. Which is pretty terrible from all perspectives - Users get prompts that require decisions that they don't have the knowledge or context for. - Valid sites & businesses lose traffic because some users are scared away by scary sounding prompts that they don't understand. - Malicious sites still get a broad swath of data on users who don't give a rats ass about the prompts and have been conditions to just always hit yes. I think this style of implementation is basically always indicative of a failure.