What Is the Geolocation API?

The Geolocation API is a browser standard that allows websites to request your precise geographic location. When a site uses this API, your browser displays a permission prompt asking whether you want to share your location. Unlike most browser fingerprinting techniques, the Geolocation API requires explicit user permission. For the overview of where geolocation fits next to DNS, WebRTC and other privacy threats, see our online privacy check guide.

When permission is granted, the API returns your latitude and longitude with an accuracy value. The W3C standard defines this value as the radius in meters within which your true position lies with 95% confidence. Precision depends on the device:

  • Mobile devices with GPS: under open sky, GPS-enabled smartphones are typically accurate to within 4.9 m (16 ft). Accuracy gets worse near buildings, bridges and trees (GPS.gov, 2022).
  • Desktop computers without GPS: location is estimated from WiFi network information or the IP address. Chrome, for example, sends information to Google Location Services to get an estimate.

The API only works on secure (HTTPS) pages in supporting browsers (MDN, 2026).

Geolocation API Privacy: What Can Websites Learn?

With permission, a website learns where you are right now, and with watchPosition() it can follow your position while the page is open. That reveals more than a single point:

  • Home and work: repeated positions at night and during the day point to where you live and work.
  • Routines: regular visits to a gym, a clinic or a place of worship can reveal sensitive details.
  • Profile building: combined with cookies or a browser fingerprint, location data links visits over time.

The W3C specification asks sites to collect only the location data they need, delete it when the task is done and not pass it on without permission (W3C, 2026). Browsers enforce the permission prompt, but they cannot control what a site does with the data afterwards.

Is Location Data Protected by Law?

Yes, in many places location data counts as personal data. The EU's GDPR names "location data" in its definition of personal data (Art. 4(1)), so sites need a legal basis such as consent to process it. In California, the CCPA treats precise geolocation as sensitive personal information, and consumers can tell businesses to limit its use (California Attorney General, 2026). A law does not stop collection by itself, so your browser settings remain the first line of defense.

How to Control Geolocation Access

You control the Geolocation API through your browser's site permissions. Set a default, then review the sites that already have access.

Block Geolocation in Chrome

Go to Chrome Settings → Privacy and Security → Site Settings → Location. Set it to "Don't allow sites to see your location". By default, Chrome asks you when a site wants to use your location (Google, 2026).

Block Geolocation in Firefox

Go to Firefox Settings → Privacy and Security → Permissions → Location. Click Settings next to Location to manage which sites have access.

Mobile devices

On phones, two layers apply: the browser's site permission and the operating system's location permission for the browser app. Turn off location for the browser app in the system settings if you never need it on websites.

SettingBlocks Geolocation APIBlocks IP-based location
Deny the browser promptYes, for that siteNo
Block location by default in the browserYes, for all sitesNo
Turn off location for the browser app (mobile)YesNo
VPNNoYes, shows the VPN server's location
Tor BrowserNo (permission still needed)Yes, shows the Tor exit's location

IP-Based Geolocation (No Permission Required)

Even if you deny the Geolocation API permission, websites can still estimate your location from your IP address. IP-based location is usually less precise than GPS, but it often shows your country and city. Read our IP address lookup guide to see what an IP reveals and how accurate it is.

The only way to prevent IP-based geolocation is to use a VPN or Tor Browser to mask your real IP address. See our Tor Browser privacy guide for correct usage.

Watch for other signals that can contradict your VPN location:

  • Time zone: your browser reports its time zone and UTC offset to every site.
  • Language: your preferred languages hint at your region.
  • WebRTC: a WebRTC leak can expose your real IP address and with it your real location.

How to Check What Your Browser Reveals About Your Location

You can test the location data websites see without granting any permission:

  1. Open the SpeedIQ test page.
  2. Run IP Geolocation. It shows your public IP, country and city as seen through ipinfo.io.
  3. Run Timezone Leak. It shows your browser's time zone and UTC offset.
  4. Run Lang Detection. It lists your preferred languages.
  5. Switch on your VPN and repeat. The IP location should change. If the time zone still points to your home region, sites can notice the mismatch.

SpeedIQ does not call the Geolocation API, so it never asks for your precise position. The results stay in your browser.

→ Try it free: You can check what your browser reveals directly at SpeedIQ. No account, no ads, results in a few seconds.

FAQ

Can a website get my location without permission?

Not through the Geolocation API, which always needs your permission. But a website can estimate your country and often your city from your IP address without asking.

How accurate is the Geolocation API?

It depends on the device. GPS-enabled smartphones are typically accurate to within 4.9 m under open sky, while desktops without GPS use WiFi or IP data and are less precise.

Does a VPN hide my location?

A VPN hides your IP-based location and shows the VPN server's location instead. It does not block the Geolocation API, so keep location permission off in your browser.

How do I stop websites from asking for my location?

In Chrome, go to Settings, Privacy and Security, Site Settings, Location and choose not to allow sites to see your location. In Firefox, manage it under Settings, Privacy and Security, Permissions, Location.

Is my location data personal data under GDPR?

Yes. The GDPR names location data in its definition of personal data, so websites need a legal basis such as consent to process it.

Sources