Glossary

Geolocation API

Geolocation API is a W3C browser interface, reached through navigator.geolocation, that returns a device's latitude, longitude and accuracy radius once the user allows it. It only works in secure contexts, so a page served over plain HTTP gets a denial. The W3C specification became a Recommendation on 1 September 2022 and returned to Candidate Recommendation in March 2026. The number people search for is accuracy, which is a radius in meters at 95% confidence.

How it works

The API has three methods on navigator.geolocation: getCurrentPosition() for a single fix, watchPosition() for repeated updates that returns a numeric watch ID, and clearWatch() to stop one. Each takes a success callback, an optional error callback and an optional options object. The browser shows a permission prompt the first time, and the permission can be denied or revoked at any time.

A successful call hands you a GeolocationPosition with a timestamp and a coords object. The coords fields are:

  • latitude and longitude in decimal degrees
  • accuracy in meters, a 95% confidence radius
  • altitude and altitudeAccuracy in meters, or null if unavailable
  • heading in degrees clockwise from true north, or null when stationary or unknown
  • speed in meters per second, or null when unavailable

The options object has three members. enableHighAccuracy defaults to false and is only a hint, and the spec warns it can slow responses. timeout is in milliseconds and defaults to 4294967295 (0xFFFFFFFF), which in practice means wait forever. maximumAge is in milliseconds and defaults to 0, meaning no cached position is accepted. The time spent waiting for the permission prompt does not count against timeout.

Failures arrive as a GeolocationPositionError with code 1 (PERMISSION_DENIED), 2 (POSITION_UNAVAILABLE) or 3 (TIMEOUT).

The sample below uses a hand-written coordinates object, because Node has no geolocation. It measures the great-circle distance to a target with the haversine formula and compares it to accuracy.

const coords = { latitude: 48.8584, longitude: 2.2945, accuracy: 25 };
const target = { latitude: 48.8606, longitude: 2.3376 };
const R = 6371008.8; // mean Earth radius in meters
const rad = d => d * Math.PI / 180;
function haversine(a, b) {
  const dLat = rad(b.latitude - a.latitude), dLon = rad(b.longitude - a.longitude);
  const h = Math.sin(dLat / 2) ** 2 +
    Math.cos(rad(a.latitude)) * Math.cos(rad(b.latitude)) * Math.sin(dLon / 2) ** 2;
  return 2 * R * Math.asin(Math.sqrt(h));
}
const d = haversine(coords, target);
console.log(Math.round(d) + " m");
console.log(d > coords.accuracy ? "outside the 95% accuracy circle" : "inside the accuracy circle");

Output:

3163 m
outside the 95% accuracy circle

What does the Geolocation API accuracy value mean?

The accuracy value is the radius, in meters, of a circle around the reported coordinates that contains the true position with 95% confidence. A value of 25 means the device is probably within 25 m, not exactly at the point. Treat the position as a circle, not a pin, and ignore results whose accuracy is too coarse for your use.

Common pitfalls

  • Calling it on plain HTTP: the request is rejected with PERMISSION_DENIED in a non-secure context, with no prompt shown. Serve the page over HTTPS, including local testing hosts the browser treats as secure.
  • Blocked by an iframe policy: the default allowlist for the geolocation feature is the page's own origin, so a cross-origin iframe is denied unless the parent grants it through a Permissions-Policy header or an allow attribute.
  • Leaving timeout at its default: the default is effectively unlimited, so a user with no signal waits forever. Set a timeout such as 10000 and handle code 3.
  • Treating a cached fix as fresh: a nonzero maximumAge can return an old position. Check the timestamp if freshness matters.
  • Assuming null means zero: heading, speed and altitude are null when unknown. Test for null before doing math, since null coerces to 0 in arithmetic.
  • Never clearing a watch: watchPosition() keeps running until clearWatch() is called with its ID, which drains battery on a long-lived page.

Related terms

  • HTTPS — the secure context the API requires
  • Permissions-Policy header — controls whether embedded frames may use geolocation
  • DOM — the document model whose navigator object exposes the API
  • Web Share API — another permission-gated device feature that needs a secure context
  • PWA — installed web apps often use location for maps and delivery features

See also

  • Term: Permissions-Policy header — shows how to allow or block geolocation per frame