I imagine this would end up in a situation where most companies ask for everything, just like the privacy / permissions requests we see when installing mobile apps.

It seems like it would be a lot better than what we currently have, though. At least there would be a market for companies that aren't shitty about it.