When Should You Request Geolocation Permission? Complete Guide (2026)

Pre-Prompt Copy: What Converts vs. What Fails

The pre-prompt is the only chance to explain the value before the irreversible native dialog. Specificity wins; vague benefits lose.

How to Implement the Pre-Prompt Pattern

1. Remove any auto-call to getCurrentPosition on page load, in route handlers, or in analytics scripts.
2. Add a feature entry point — a button like "Use my location" alongside a manual ZIP / city input.
3. On click, show a custom modal with the specific benefit and a privacy note.
4. Only after the user accepts, call navigator.geolocation.getCurrentPosition().
5. Handle errors: PERMISSION_DENIED, POSITION_UNAVAILABLE, TIMEOUT.
6. Always fall back to manual entry when permission is denied or fails.

Pre-prompt then native prompt with manual fallback

document.querySelector('#use-location').addEventListener('click', async () => {
  const accepted = await showPrePrompt({
    title: 'Find the nearest store',
    body: 'We use your location once to show stores within 10 miles. Nothing is stored.',
  });
  if (!accepted) return showZipInput();

  navigator.geolocation.getCurrentPosition(
    (pos) => renderNearbyStores(pos.coords),
    (err) => {
      if (err.code === err.PERMISSION_DENIED) {
        showZipInput('Location blocked. Enter ZIP instead.');
      } else {
        showZipInput('Could not get location. Enter ZIP instead.');
      }
    },
    { timeout: 8000, maximumAge: 60_000 }
  );
});

Check current permission state without prompting

// Permissions API lets you check state without triggering the prompt
async function canRequestLocation() {
  if (!('permissions' in navigator)) return true;
  const status = await navigator.permissions.query({ name: 'geolocation' });
  return status.state !== 'denied'; // 'granted' or 'prompt' are both ok
}

Common Mistakes

• Calling getCurrentPosition at the top of a route component or in useEffect(() => ..., []) with no gesture.
• Skipping the pre-prompt and burning the one chance the native dialog gives you.
• Treating denial as terminal — always offer manual ZIP / city / postcode entry.
• Using watchPosition when getCurrentPosition is enough; continuous tracking is much harder to justify under GDPR.
• Forgetting that geolocation requires HTTPS — it silently fails on plain HTTP.
• Asking for precise coordinates when city-level location (from IP) would do.

How to Test Geolocation UX

1. Run an automated audit and confirm "Avoids requesting the geolocation permission on page load" passes.
2. In Chrome DevTools, open the Sensors panel and override location to verify the flow works for non-local users.
3. Reset the site permission via the lock icon and reload to confirm no prompt appears unprompted.
4. Test the manual fallback path by clicking "Block" in the native dialog.
5. Verify the page works on plain HTTP (locally) — geolocation should be disabled, with a clear message.

See also our guide on notification permission timing and why HTTPS is required for permission-gated APIs.

FAQ

Why does an automated audit fail my page for asking on load?

The audit "Avoids requesting the geolocation permission on page load" fails when getCurrentPosition or watchPosition runs without a user gesture, because the resulting denial is sticky and unrecoverable.

Does geolocation work on HTTP?

No. Chrome 50, Firefox 55, and all modern browsers restrict geolocation to secure contexts (HTTPS or localhost). On HTTP the API call resolves with POSITION_UNAVAILABLE or is blocked outright.

Can I re-ask after a denial?

No. Once the user blocks geolocation for your origin, the browser will not show the prompt again. The user has to manually re-enable it in site settings, which almost never happens.

What is the difference between getCurrentPosition and watchPosition?

getCurrentPosition reads location once. watchPosition subscribes to updates until you call clearWatch. Use getCurrentPosition unless you genuinely need live tracking.

Do I need GDPR consent for geolocation?

If you store, transmit, or process the location data, yes — GDPR Article 4 classifies precise location as personal data. The browser prompt alone is not GDPR consent; you also need a clear-language explanation and a lawful basis.

What is a good fallback when permission is denied?

Manual ZIP / postcode / city input, or city-level IP geolocation for non-sensitive features like local weather. Never block the feature entirely.

Can I detect denial without prompting?

Yes. Use navigator.permissions.query({ name: 'geolocation' }). It returns granted, denied, or prompt without triggering the dialog.

Does this affect AI search engines like ChatGPT and Perplexity?

Yes, indirectly. A premature geolocation prompt drives high denial rates and quick bounces, which feed user-engagement signals reflected in Page Experience and the third-party usage data AI search engines like ChatGPT, Perplexity, and Google AI Overviews use to weight a source. Pages users abandon before reading are less likely to be cited as authoritative answers, regardless of underlying content quality.