How does the Geolocation API work and what are its privacy implications?

navigator.geolocation.getCurrentPosition() asynchronously requests the user's location, always requiring explicit browser permission first. It should only be called after a clear user action, since silent location requests are a major privacy red flag and often blocked or flagged by browsers.

navigator.geolocation.getCurrentPosition(
  pos => console.log(pos.coords.latitude, pos.coords.longitude),
  err => console.error(err.message)
);