[IanDrake]

Devils advocate here.

Isn't just visiting the site giving consent to allow the sandbox (browser) to be utilized as the site directs?

This is an extreme case, granted, but it's still within the bounds of the sandbox.

Perhaps we'll have a new browser setting soon to throttle this type of thing instead of having to go whole hog and turn of JavaScript.

[TeMPOraL]

The implied consent is based on trust. The browser is my user agent, it is meant to interpret the data that it gets from HTTP stream the way I want it. I let it do the things as specified in the received data (i.e. by you), because I trust that you're not an asshole and will not abuse that power.

Unfortunately, there are plenty of assholes on-line, who decided to abuse the default behaviour - so now we have ad blockers and reader modes.

Ultimately, it is (by intention and design of the HTTP protocol, and computer networks in general) up to me what I do with the data - if, how, and which parts of it I decide to process.

[clarry]

It is giving consent, in some sense. But make a popular website use visitors' browsers to launch a DDoS attack and you'll find that "anything goes as long as it's the bounds of the sandbox" doesn't really apply.

Apart from that, people can easily take a different view altogether. When I visit a site, I download some bits. Doing so I don't consent to anything -- what I do with these bits is up to me.