> Whether the browser should require your permission (per site?) to use device orientation API, that's debatable. Anyway, that's up to the browser implementation.

I think anything that involves making new/more input available to remote sites should require opt in. At the very least it should have a toggle to disable it globally.