[higherpurpose]

Why can't they just disable WebRTC by default and ask the user for permission like they do with location and so on, without revealing the IP before the user accepts the connection? Also, maybe the user could easily whitelist some connections/WebRTC IDs?

[jon-wood]

I'm not sure asking permission really helps. With things like location and video end users at least know what it means, and can make a somewhat educated choice. How do you properly ask an uneducated user the question "Should this site be allowed to open an arbitrary data connection?" - sites that want to will think of some vaguely plausible reason and users will click away.