If it isn't an informed decision, it isn't really a decision at all. And the huge majority of people the huge majority of the time do not want to make an informed decision: they want what they came to the site for, news, games, family photos, etc.

You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!

It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.

So long as it's once per API and site, it seems it doesn't need to be too bad?

If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).

We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.

Also, people not in tech do not generally understand the implication of consent popups.

For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.

"This smart lock app doesn't work."

"You need to enable this permission."

"Why do I need to give the smart lock app location permissions?"

It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.