Comment by bastawhiz
If it's blocked by default and you need to interact to opt in, isn't the default "block on every visit"? The only reason it's an option now is to avoid the modal popping on every visit, which isn't a concern for this proposal.
Edit: Not sure why I'm being voted down? Can someone who disagrees with my statement explain why you'd click a button with the goal of opening a modal to deny a permission when the permission is already blocked?
It depends on how styleable the <permission> element ends up. I don't imagine any website will use it if it's limited to being an ugly default button with non-configurable text. But if the button is configurable enough, there's nothing to stop websites from abusing it for permission spam, just like the current model is.
Basically, I expect users wil stil need a way to defend against permission spam.