> It doesn't need to a privacy invasion.
Of course it does. If a user could grant permission, then a hacker could pretend to be the user and grant himself permission. It would represent a huge vulnerability, because at the exact moment that a hacker figures out a user's password, he also has access to that person's browsing history, including everywhere the victim shopped online, which would quickly become places that the hacker shops online, using the victim's identity.
No, a history log accessible to anyone pretending to be John Doe, would mean the end of the real John Doe. It would make identity theft much more dangerous that it is already.
> There are many potential benefits of allowing access.
There are also many potential benefits to doing away with privacy altogether, but that doesn't make the idea persuasive.