This might be easier than refusing permission every time - it sounds like I can just not click it. I really dislike location permission things. I don't know what location will be shared, I don't use anything that needs a precise location, and I don't ever want to share my actual location. If location permission things showed me a map with where they think I am and let me click a (vague) location to share, I might use them, but currently to find nearest stores or whatever I just type in a postcode or use their map.
Edit: this has prompted me to go find a way to turn off location permission requests in the browser settings. It turns out you can do it under Privacy and Security > Site Settings in Firefox and Chrome.
likiiio 28 minutes ago [-]
Me too. I don't share precise location but will happily click on a map if a website gives me the option. For things that i really need, i just use dev tools to manually set the location :)
mpeg 21 hours ago [-]
This element has an autolocate attribute that will request permission automatically, plus it doesn't supersede the JS api, it simply provides a declarative alternative to it, so sites that follow this negative pattern will keep doing so.
At the same time, there is no reason to not implement this pattern today and require user intent prior to requesting the permission
jauco 20 hours ago [-]
According to the post, autolocate only does something after a user initiated permission has been granted.
So on the first vist you still need to click the button. On the second visit the callback will be triggered directly.
But, well, nothing prevents a big fat html modal on the page pointing to the button, now does it? If you want to annoy your product^H^H^H^H^H^H^Husers then you can always find ways to do so.
ivanjermakov 24 hours ago [-]
> easier than refusing permission every time
Most browsers allow setting default permissions for all sites at once.
mkl 24 hours ago [-]
Not default permissions, it turns out, but you have a global choice between letting sites ask for permission or blocking the requests entirely.
marginalia_nu 1 days ago [-]
This seems pretty sketchy, and I don't really understand what prevents a website from clickjacking.
The original flow is awkward, but also renders the permission element in a location that can't be clickjacked, thus offering some protection from geolocation.
adzm 1 days ago [-]
It still pops up a permission confirmation dialog
bflesch 24 hours ago [-]
It explicitly pops up the confirmation dialog even though user has previously DENIED that geolocation permission dialog. The whole thing is only created because they see "high denial rates" and want to create a way to permanently undo these denials.
jeroenhd 24 hours ago [-]
The spec doesn't mandate such behaviour, that's up to the user agent to implement.
I've had to deal with plenty of people who couldn't do things like use Jitsi or other web apps because they missed or denied the permission prompt before reading them. The tiny icons in the address bar are barely recognised as clickable items by most users, which is a good thing for toning down annoyances but an awful inconvenience when trying to help people.
In a few cases, the solution to "accidentally dismissed permission popup" was "make everyone else download an app full of trackers".
bflesch 24 hours ago [-]
Jitsi is about audio / video where this would make more sense, not about geolocation.
Geolocation based on IP address is always done in the background, so they already know what city you are from. But Google wants to have the nice high-precision location from our GPS chips so they can permanently associate the IP address, and available WIFIs/Bluetooth/network devices and all related MAC addresses to a specific building.
And they want to have this specific functionality so they can organically trick non-power-users who got accustomed to the permission popup dialogs into re-sharing their location.
jeroenhd 20 hours ago [-]
> Geolocation based on IP address is always done in the background, so they already know what city you are from
They don't. Maybe the trackers do, but most websites place me 100km to the west. When I want to look up opening times for supermarkets near me, I like the "show nearby" button.
Even Google gets confused because I VPN back to my home network. Every time I spend a few days somewhere else, Google's IP-based geolocation is broken again.
wongarsu 23 hours ago [-]
The audio/video version is in the works [1]. I imagine geolocation just got to this stage first because it's far simpler.
And IP-based geolocation is really unreliable beyond the country level. It depends on ISPs using a different pool of IP addresses for each city. That seems to be the norm in the US, but is not how every ISP runs their operation
Oh come on please stop this insincere false narrative. IP-to-geolocation works extremely well even with semi-public databases, and Google has spent billions on collecting a very powerful database of it.
Google is internally fusing data from all devices that were ever in your LAN or near your WIFI access point. It merges them based on:
- outside IP address given by ISP and mobile phone carriers
- list of network devices incl. IP address & MACs (do you have a 3d printer or not?)
- any info they can extract via their Smartphone Apps both on Android and IOS
- Android devices share geolocation data with google anyways
- user agents & browsing history on google properties and 3rd party websites
- every time your IP addresses hit anything in google cloud or google CDNs (e.g jquery from googlestatic.com or google fonts)
- all data you have ever provided to them (payment data, gcloud, gmail)
- all the tracking that is already built into chrome and other google software
Plus they procure data from third-party providers. Only a single app on your smartphone needs to have geolocation privilege and then the data (location, ip address and user data) is available for google to digest via their scripts/SDKs which are packaged into basically every smartphone app.
The large tech companies have significant incentive to mutually share data with each other, that's why you often see Javascript from one tech company included in the website or product of another one. It's enough to touch a google dc with a single packet included in the facebook app for them to associate your session with the new IP address and vice versa.
Google has years of data on how often user agents and devices behind a certain IP address change. They can very confidently say if your ISP-provided IP address has been rotated or not, and where it was rotated to. They most definitely have enough GPS positions from smartphones that they can predict where you sleep, so if your smartphone shows up under another IP address but the network devices around it stay the same they can easily deduce that this is your new dial-up IP address.
All of this not even discusses unethical or clearly illegal ways these companies have acquired data by abusing a lack of security measures on the smartphone operating systems. An example is Facebook uploading entire smartphone contact books to their servers to fuel their "organic" growth - Google most definitely has done exactly the same.
The "careless people" book highlights that Facebook deployed spyware with their smartphone apps which monitored what other apps the users were using - this is how they figured out that WhatsApp was going viral and based on this data they did the surprise acquisition of WhatsApp. I'm confident that google abuses the same security vulnerabilities in order to further collect data.
anamexis 21 hours ago [-]
Maybe I’m missing something, but Google does not offer an IP Geolocation service or publish their database.
Of course they don't share the final database, because it is their core asset.
And if the common public catches a glimpse of the data that google has saved they would be really upset.
anamexis 17 hours ago [-]
That is not IP Geolocation.
8bitsrule 9 hours ago [-]
One of the first times I used a Google product to show me my location (over a decade ago), it showed me a zoomed-in satellite picture of the parking lot right next to my apartment.
(It didn't take me long to realize the implications.)
kitd 23 hours ago [-]
> Jitsi is about audio / video where this would make more sense, not about geolocation.
It's still permission-based. And the article mentions that the same ux is being done for media objects.
crote 1 days ago [-]
I'm a bit confused about how it actually works, and somehow they decided to not include a demonstration video.
If clicking on it does trigger a location permission prompt: what's the point? The "issues" with prompts getting denied can already be solved by web developers doing this themselves, rather than just blindly firing off a request on page load.
If clicking on it does not trigger a location permission prompt: have we forgotten about the Line Of Death [0]? Clicking random website-styled elements should never result in dangerous actions being taken - and leaking the user's physical location is definitely dangerous. Sure, they are trying to restrict the styling, but that's a fools' errant: somebody will just make a browser game where the button looks to refer to something ingame, but actually leak your real-world location.
Besides, who's actually asking for this? Location is perhaps useful for Google Maps-like websites to save you a few seconds of scrolling, but in practice it has mostly been spammy websites trying to get me to "subscribe to local news". Making geolocation easier is the last thing I want in my browser!
> The "issues" with prompts getting denied can already be solved by web developers doing this themselves
Does that mean identifying the browser and trying to tell the user how to go into the browser settings and un-block permission prompts?
crote 23 hours ago [-]
No, I mean adding a "use your location" button yourself which the user has to click before it uses the geolocation API, rather than just blindly requesting it on page load.
The only reason people block it in settings is because they get sick of nagging prompts they never asked for.
rawling 22 hours ago [-]
Ah, gotcha. So this change is giving developers a more standardised way to follow that "add a button, pop up permission dialog" pattern that will hopefully drive more of them away from the bad pattern?
jeroenhd 24 hours ago [-]
You get prompted to supply your location just like normal.
Using geolocation on the web is not something I do daily, but I do use it every now and then. The "locate stores near me" button for looking up store closing times is a lot easier than manually panning across a map.
I find Chrome's current implementation (on Android) to be acceptable as long as measures are taken to prevent clickjacking and such to automate repeating prompts after denying permissions. I expect other browsers like Firefox to be more conservative in showing popups like that.
21 hours ago [-]
IshKebab 22 hours ago [-]
Presumably at some point they'll turn off script-triggered location access or make it less undesirable for sites in some way.
quiet35 18 hours ago [-]
The main intent behind this seems to be constantly reminding users that enabling geolocation is an option, and that it is an ordinary thing to do. Dear user, why don't you still use it, everyone does it. Just click the button!
arcfour 9 hours ago [-]
Yes, because users don't like when things don't work, and they don't think about that time they blindly dismissed a permission notification and don't understand how to go undo that easily.
So we make it easier for the user to actually do the thing they intend to do. Seems good to me.
SquareWheel 23 hours ago [-]
Contextual permissions are a big improvement over early and uncertain prompts. I will never agree to grant my permission when first loading a page, however, I may do so if intentionally activating a map widget. At least then I understand the context by which it's being asked, and can make a more informed decision.
nake89 1 days ago [-]
I'm curious to why the polyfill example uses unpkg.com. It is quite unreliable and has broken sites many times.
I am not affiliated in anyway to jsdeliver or unpkg. I simply used to be a user on unpkg.
bflesch 1 days ago [-]
Maybe for tracking purposes, because most google-affiliated CDNs are widely blocked and unpkg might be small enough to not immediately raise eyebrows with devs. Unpkg removed their SPONSORS.md file recently, and their README claims to be hosted at fly.io which seems to be behind Cloudflare.
Works on my phone (after enabling the experiment in chrome-flags). Even includes localised permission prompts.
1023bytes 23 hours ago [-]
Also crashed for me on Chrome on Mac
Barathkanna 21 hours ago [-]
This mostly changes how location is requested, not what you can do with it. Instead of imperative JS calls, location access becomes declarative in HTML, which gives browsers more context for permission UX and auditing. Your app logic, data flow, and fallbacks don’t change, and you’ll still need JS to actually use the location. Think of it as a cleaner permission and intent layer, not a new geolocation capability.
grugdev42 24 hours ago [-]
I just don't get it. Why is this needed?
But I have no doubt there is a play happening here.
Probably it will change over time to make gathering data easier?
Or something else that makes Google money.
vjerancrnjak 23 hours ago [-]
google.com/maps to capture your location across the whole domain easier than before
maelito 23 hours ago [-]
Google maps on mobile is directing the user to the native app more and more. So I doubt this. Geolocation on desktop is mostly useless.
mdhb 24 hours ago [-]
Try to use some critical thinking here before immediately jumping into conspiracy theories. Maybe start with reading the actual post rather than just seeing Google and geolocation in the same sentence and forming your opinion based on that.
g947o 22 hours ago [-]
I don't think anyone can give Google the benefit of doubt after Manifest v3, Privacy Sandbox/FLoC, Web Environment Integration, and Android developer verification etc, all of which faced strong opposition, some of which they abandoned. That's easily four just from the last few years. See the pattern? On the surface, they talk about security and privacy (and they do, to some extent), but at the core they will benefit Google's various businesses and their dominant positions while hurting the ecosystem and competition. Honestly I can't even think of another big tech that acts in such a bad faith.
Not to mention Google's history of pushing some non-standard behavior into Chrome single handedly to make it the de facto behavior, ignoring voices questioning the motivation, timeline and technical implementation. They are discussed here on HN and everywhere else and easy to find.
Coming back to this, my response is the same: the status quo works, why change it? Similar to how Mozilla responds to replacing user agent with "Hints API" nonsense. I don't want another way to get my location, because I already block all location requests. Google wants site owners to get location more easily out of unsuspecting users. I can't see how this is good for anyone but Google and its friends.
bflesch 24 hours ago [-]
Unfortunately extending benefit of the doubt towards US tech companies is a luxury not everybody can or wants to afford. There is a clear pattern of enshittification of their products.
As you assume that GP has not read the post, how about you?
Because google clearly state that the "high denial rates" are a problem, but their framing of the issue is that the users have a "context gap" which needs to be fixed. Because they are convinced that even though users have decided against geolocation sharing with a specific website they want to get prompted about it over and over again as part of the organic interface of the website. And if they un-block it once over the new interface then the previous block will be forgotten and the permission will forever be granted.
A solution respecting their users would be to allow geolocation for duration of the browser tab, but that is clearly not in line with their data collection goals for their advertisers.
Crpt774 21 hours ago [-]
A permission request every browser session also wouldn't be in line with the needs of the average end user, and would train them to hit accept on any prompt that arises, as if they didn't do that enough anyway.
grugdev42 20 hours ago [-]
Critical thinking DOES suggest that Google have the means, motivation, and opportunity to nefarious things for profit.
Thinking that everything Google produces might not be positive is NOT jumping into conspiracy theories.
bflesch 1 days ago [-]
Main purpose of this seems to offer a way for undoing "previously blocked location access" by the user.
> If a prompt appears unexpectedly, users may block it reflexively or accidentally, unaware that this decision creates a permanent block that is difficult to reverse. This context gap—rather than the feature itself—is a primary driver of high denial rates.
> If a user previously blocked location access when browsing a site (perhaps by accident or lack of context), clicking the element triggers a specialized recovery flow. This helps them re-enable location at the moment when they actually want to use location, without the friction of navigating deep into the browser's site settings.
Google sees "high denial rates" when they try ask users for their geolocation. This is a problem for Google's customers, the advertisers. So they introduce this <geolocation> HTML tag so that dark patterns can be employed to trick users into permanently sharing location even though they have blocked location sharing before.
If the Google engineers who are working on this feature would actually give a damn about users who decided to block geolocation access, this feature would be designed as a "temporary access to geolocation for duration of browser session".
So basically it is all about more tracking and less data privacy.
It's overdue that skilled engineers provide better solutions than this crap, but of course it's much easier to be apolitical and become a millionaire working for a bunch of tech bros who visited Epstein's island.
vachina 24 hours ago [-]
Yeah they cited Zoom as a successful case study, but why does Zoom need access to my location in the first place? Asking me when I click the <geolocation> button will not change my decision to block.
Also I’m not sure about the argument of context disconnect. Properly designed websites will only ask for (and prompt the location permission modal) when it really needs it.
mkl 24 hours ago [-]
The Zoom mention was about camera and microphone permission with <permission>, not location:
> Zoom reported a 46.9% decrease in camera or microphone capture errors
LordHeini 16 hours ago [-]
I assume an adblocker can remove those.
That would be a net benefit because pages requesting location for no reason end up in the block list and don't annoy me anymore.
troupo 1 days ago [-]
Even though the other browser vendors have positive reaction, note how this follows the same pattern Chrome has followed for over a decade:
- scribble on a napkin (explainer)
- ask others for their position
- ship regardless of position or any outstanding issues
- claim it's a new standard
breakingcups 1 days ago [-]
I'm not familiar with how this process went in this case, the blog post seems to suggest that feedback from other vendors was incorporated. Can you elaborate on the outstanding issues?
troupo 1 days ago [-]
If you follow the links to browser positions, there are still discussions about various concerns that don't seem to have been addressed.
zero0529 22 hours ago [-]
This is pretty cool. But what gets me really excited is the new generic <Permission>[0] element. I had to implement a webcam element one time for some CV pet project and I had a lot of trouble getting the basic api to just work (Highly likely a skill issue). So seeing that this will also expand to webcam and other IO seems like a really good UX improvement.
Why not just expose a GeoLocationEvent and call it a day? why add another element people will wrap anyway?...
voxadam 21 hours ago [-]
Adding a new HTML element probably leads to a better bonus at Google.
notnullorvoid 5 hours ago [-]
There probably is a bonus associated with each web proposal you create and get accepted. It's most frustrating when they take an existing proposal by an outsider chop it up into several separate proposals, and somehow still manage to miss the point of the original while simultaneously making it all more complex.
As noted in the intent to ship for both, these are a very specific narrow cases chipped off a bunch broader attempt to offer declarative ways to handle permissions in general, a <permission> element.
The root problem is that permissions right now are super hard to adjust for users (and the way they are exposed to the page is not very good at dealing with users turning permissions on and off either). It's imo very good that we are finally leaving this awful tarpit of design, & moving towards permissions being more fluid. I get that other browsers wanted to be conservative & not do a generic <permission> element, but given how big an improvement this feels like, I sort of wish it'd gotten the pass.
bflesch 23 hours ago [-]
> The root problem is that permissions right now are super hard to adjust for users
Unlike you I'm not getting paid enough by google to accept this narrative. The root problem for google is "high denial rates" of geolocation prompts, as clearly stated by Google in the post.
Now please tell me what information the geolocation prompt actually provides to the website that cannot be taken from the IP address, which is already tracked and processed by google and every single website tracking tool. IP address tells the website about the city where users come from.
The root problem with "high denial rates" is that Google wants to know if you live in the rich part of town or in the poor part of town. This is why google engineers try to find new ways for users to permanently undo their blocking of geolocation permission.
If google engineers had any concern about their users, then the default option would be a way to temporarily allow geolocation for duration of the browser session, e.g. when you need to really use google maps. And after the browser window closes it would later go back to the previously blocked state from before.
It's a cognitive dissonance.
_flux 21 hours ago [-]
> Now please tell me what information the geolocation prompt actually provides to the website that cannot be taken from the IP address, which is already tracked and processed by google and every single website tracking tool.
Show me the bus schedule for the nearest bus stop, show me the nearest store, share my location in a chat..
The browser's IP-based geolocation (as per what https://mylocation.org/ can find out from my session) is kilometers away.
eagleal 21 hours ago [-]
Google is not using exclusively DBs like MaxMind for geolocation though. They fuse a lot of data together and probably can even discern which building you're on from the other local network devices without the precise geolocation sharing.
Like the Meta/Yandex apps were doing, just not strictly for position tracking, but more centered toward pinpointing your unique id.
_flux 20 hours ago [-]
As I understand it, this tag might be at some point be supported by non-Google browsers as well, without access to Google internal databases. At first probably the Chromium-derived ones, which this tag probably lands up at some point.
jauntywundrkind 12 hours ago [-]
Strava apps, FourSquare apps, proximity to friend alerts...
It's really disappointing how doubt and suspicion have rotted some people's brains. Any and every work being viewed with searing doubt is such an unfortunate fate, that consigns humanity away against progress and possibility.
As a developer of fun personal website toys for myself & friends, I want to do good things. I want a better web platform. Oh I can download third rate geo-ip databases to do a bad job inaccurately spying on people who maybe dont want to be spied on, and that won't work with VPN's/tailscale? So what? That sounds infernal as heck. None of the post engages with the subject matter, it's all whinge about something else.
And I didn't stop at geolocation. Usermedia is even more used, everyday by many many people. The ability to turn that in and off fast is crucial to users having control.
This morose-ith is right up there with the right wing batshittery that protestors are paid: people so far gone into a conspiracy world of vice that they literally cannot believe in good and hope, even when it's right ahead of them.
But, PS, Google, I still haven't seen any checks (actually I got a summer of code long long ago), so, please, get those moving!
fateelena 4 hours ago [-]
[dead]
Rendered at 09:18:58 GMT+0000 (Coordinated Universal Time) with Vercel.
Edit: this has prompted me to go find a way to turn off location permission requests in the browser settings. It turns out you can do it under Privacy and Security > Site Settings in Firefox and Chrome.
At the same time, there is no reason to not implement this pattern today and require user intent prior to requesting the permission
So on the first vist you still need to click the button. On the second visit the callback will be triggered directly.
But, well, nothing prevents a big fat html modal on the page pointing to the button, now does it? If you want to annoy your product^H^H^H^H^H^H^Husers then you can always find ways to do so.
Most browsers allow setting default permissions for all sites at once.
The original flow is awkward, but also renders the permission element in a location that can't be clickjacked, thus offering some protection from geolocation.
I've had to deal with plenty of people who couldn't do things like use Jitsi or other web apps because they missed or denied the permission prompt before reading them. The tiny icons in the address bar are barely recognised as clickable items by most users, which is a good thing for toning down annoyances but an awful inconvenience when trying to help people.
In a few cases, the solution to "accidentally dismissed permission popup" was "make everyone else download an app full of trackers".
Geolocation based on IP address is always done in the background, so they already know what city you are from. But Google wants to have the nice high-precision location from our GPS chips so they can permanently associate the IP address, and available WIFIs/Bluetooth/network devices and all related MAC addresses to a specific building.
And they want to have this specific functionality so they can organically trick non-power-users who got accustomed to the permission popup dialogs into re-sharing their location.
They don't. Maybe the trackers do, but most websites place me 100km to the west. When I want to look up opening times for supermarkets near me, I like the "show nearby" button.
Even Google gets confused because I VPN back to my home network. Every time I spend a few days somewhere else, Google's IP-based geolocation is broken again.
And IP-based geolocation is really unreliable beyond the country level. It depends on ISPs using a different pool of IP addresses for each city. That seems to be the norm in the US, but is not how every ISP runs their operation
1: https://developer.chrome.com/origintrials/#/view_trial/37362...
Google is internally fusing data from all devices that were ever in your LAN or near your WIFI access point. It merges them based on:
Plus they procure data from third-party providers. Only a single app on your smartphone needs to have geolocation privilege and then the data (location, ip address and user data) is available for google to digest via their scripts/SDKs which are packaged into basically every smartphone app.The large tech companies have significant incentive to mutually share data with each other, that's why you often see Javascript from one tech company included in the website or product of another one. It's enough to touch a google dc with a single packet included in the facebook app for them to associate your session with the new IP address and vice versa.
Google has years of data on how often user agents and devices behind a certain IP address change. They can very confidently say if your ISP-provided IP address has been rotated or not, and where it was rotated to. They most definitely have enough GPS positions from smartphones that they can predict where you sleep, so if your smartphone shows up under another IP address but the network devices around it stay the same they can easily deduce that this is your new dial-up IP address.
All of this not even discusses unethical or clearly illegal ways these companies have acquired data by abusing a lack of security measures on the smartphone operating systems. An example is Facebook uploading entire smartphone contact books to their servers to fuel their "organic" growth - Google most definitely has done exactly the same.
The "careless people" book highlights that Facebook deployed spyware with their smartphone apps which monitored what other apps the users were using - this is how they figured out that WhatsApp was going viral and based on this data they did the surprise acquisition of WhatsApp. I'm confident that google abuses the same security vulnerabilities in order to further collect data.
Of course they don't share the final database, because it is their core asset. And if the common public catches a glimpse of the data that google has saved they would be really upset.
(It didn't take me long to realize the implications.)
It's still permission-based. And the article mentions that the same ux is being done for media objects.
If clicking on it does trigger a location permission prompt: what's the point? The "issues" with prompts getting denied can already be solved by web developers doing this themselves, rather than just blindly firing off a request on page load.
If clicking on it does not trigger a location permission prompt: have we forgotten about the Line Of Death [0]? Clicking random website-styled elements should never result in dangerous actions being taken - and leaking the user's physical location is definitely dangerous. Sure, they are trying to restrict the styling, but that's a fools' errant: somebody will just make a browser game where the button looks to refer to something ingame, but actually leak your real-world location.
Besides, who's actually asking for this? Location is perhaps useful for Google Maps-like websites to save you a few seconds of scrolling, but in practice it has mostly been spammy websites trying to get me to "subscribe to local news". Making geolocation easier is the last thing I want in my browser!
[0]: https://textslashplain.com/2017/01/14/the-line-of-death/
Does that mean identifying the browser and trying to tell the user how to go into the browser settings and un-block permission prompts?
The only reason people block it in settings is because they get sick of nagging prompts they never asked for.
Using geolocation on the web is not something I do daily, but I do use it every now and then. The "locate stores near me" button for looking up store closing times is a lot easier than manually panning across a map.
I find Chrome's current implementation (on Android) to be acceptable as long as measures are taken to prevent clickjacking and such to automate repeating prompts after denying permissions. I expect other browsers like Firefox to be more conservative in showing popups like that.
So we make it easier for the user to actually do the thing they intend to do. Seems good to me.
jsdelivr.com is much more reliable (Multi-CDN, Multi-DNS). Comparison: https://www.jsdelivr.com/unpkg
I am not affiliated in anyway to jsdeliver or unpkg. I simply used to be a user on unpkg.
https://permission.site/geolocation_element.html
But I have no doubt there is a play happening here.
Probably it will change over time to make gathering data easier?
Or something else that makes Google money.
Not to mention Google's history of pushing some non-standard behavior into Chrome single handedly to make it the de facto behavior, ignoring voices questioning the motivation, timeline and technical implementation. They are discussed here on HN and everywhere else and easy to find.
Coming back to this, my response is the same: the status quo works, why change it? Similar to how Mozilla responds to replacing user agent with "Hints API" nonsense. I don't want another way to get my location, because I already block all location requests. Google wants site owners to get location more easily out of unsuspecting users. I can't see how this is good for anyone but Google and its friends.
As you assume that GP has not read the post, how about you?
Because google clearly state that the "high denial rates" are a problem, but their framing of the issue is that the users have a "context gap" which needs to be fixed. Because they are convinced that even though users have decided against geolocation sharing with a specific website they want to get prompted about it over and over again as part of the organic interface of the website. And if they un-block it once over the new interface then the previous block will be forgotten and the permission will forever be granted.
A solution respecting their users would be to allow geolocation for duration of the browser tab, but that is clearly not in line with their data collection goals for their advertisers.
Thinking that everything Google produces might not be positive is NOT jumping into conspiracy theories.
> If a prompt appears unexpectedly, users may block it reflexively or accidentally, unaware that this decision creates a permanent block that is difficult to reverse. This context gap—rather than the feature itself—is a primary driver of high denial rates.
> If a user previously blocked location access when browsing a site (perhaps by accident or lack of context), clicking the element triggers a specialized recovery flow. This helps them re-enable location at the moment when they actually want to use location, without the friction of navigating deep into the browser's site settings.
Google sees "high denial rates" when they try ask users for their geolocation. This is a problem for Google's customers, the advertisers. So they introduce this <geolocation> HTML tag so that dark patterns can be employed to trick users into permanently sharing location even though they have blocked location sharing before.
If the Google engineers who are working on this feature would actually give a damn about users who decided to block geolocation access, this feature would be designed as a "temporary access to geolocation for duration of browser session".
So basically it is all about more tracking and less data privacy.
It's overdue that skilled engineers provide better solutions than this crap, but of course it's much easier to be apolitical and become a millionaire working for a bunch of tech bros who visited Epstein's island.
Also I’m not sure about the argument of context disconnect. Properly designed websites will only ask for (and prompt the location permission modal) when it really needs it.
> Zoom reported a 46.9% decrease in camera or microphone capture errors
That would be a net benefit because pages requesting location for no reason end up in the block list and don't annoy me anymore.
- scribble on a napkin (explainer)
- ask others for their position
- ship regardless of position or any outstanding issues
- claim it's a new standard
- [0] https://github.com/WICG/PEPC/blob/main/explainer.md
As noted in the intent to ship for both, these are a very specific narrow cases chipped off a bunch broader attempt to offer declarative ways to handle permissions in general, a <permission> element.
Intent-to-ship for geolocation: https://groups.google.com/a/chromium.org/g/blink-dev/c/GL0Bk...
Earlier Page-Embedded Permissions Control (PEPC) proposal: https://github.com/WICG/proposals/issues/113 https://github.com/andypaicu/PEPC/blob/main/explainer.md
The root problem is that permissions right now are super hard to adjust for users (and the way they are exposed to the page is not very good at dealing with users turning permissions on and off either). It's imo very good that we are finally leaving this awful tarpit of design, & moving towards permissions being more fluid. I get that other browsers wanted to be conservative & not do a generic <permission> element, but given how big an improvement this feels like, I sort of wish it'd gotten the pass.
Unlike you I'm not getting paid enough by google to accept this narrative. The root problem for google is "high denial rates" of geolocation prompts, as clearly stated by Google in the post.
Now please tell me what information the geolocation prompt actually provides to the website that cannot be taken from the IP address, which is already tracked and processed by google and every single website tracking tool. IP address tells the website about the city where users come from.
The root problem with "high denial rates" is that Google wants to know if you live in the rich part of town or in the poor part of town. This is why google engineers try to find new ways for users to permanently undo their blocking of geolocation permission.
If google engineers had any concern about their users, then the default option would be a way to temporarily allow geolocation for duration of the browser session, e.g. when you need to really use google maps. And after the browser window closes it would later go back to the previously blocked state from before.
It's a cognitive dissonance.
Show me the bus schedule for the nearest bus stop, show me the nearest store, share my location in a chat..
The browser's IP-based geolocation (as per what https://mylocation.org/ can find out from my session) is kilometers away.
Like the Meta/Yandex apps were doing, just not strictly for position tracking, but more centered toward pinpointing your unique id.
It's really disappointing how doubt and suspicion have rotted some people's brains. Any and every work being viewed with searing doubt is such an unfortunate fate, that consigns humanity away against progress and possibility.
As a developer of fun personal website toys for myself & friends, I want to do good things. I want a better web platform. Oh I can download third rate geo-ip databases to do a bad job inaccurately spying on people who maybe dont want to be spied on, and that won't work with VPN's/tailscale? So what? That sounds infernal as heck. None of the post engages with the subject matter, it's all whinge about something else.
And I didn't stop at geolocation. Usermedia is even more used, everyday by many many people. The ability to turn that in and off fast is crucial to users having control.
This morose-ith is right up there with the right wing batshittery that protestors are paid: people so far gone into a conspiracy world of vice that they literally cannot believe in good and hope, even when it's right ahead of them.
But, PS, Google, I still haven't seen any checks (actually I got a summer of code long long ago), so, please, get those moving!