Can a website see where I am?
Only if you let it, with one exception that catches most people out. Coordinates, ZIP code, postal code, street address and elevation all require you to accept a browser prompt first. Your timezone does not, and a timezone is a place name rather than a number of hours, which makes it the quietest location leak on the web.
Location
What the Geolocation API can pin down, only with your permission.Every location signal, with the call behind it
6 signals, 5 of which ask your permission first. The entropy column is this site's own estimate of how much each signal narrows a crowd, not a measured population statistic; the methodology page explains why that distinction matters.
| Signal | JavaScript call | Permission | Entropy (bits, estimated) | Fakeable |
|---|---|---|---|---|
| Location | navigator.geolocation.getCurrentPosition(success, error) | Asks first | not counted | Yes |
| Zip code | navigator.geolocation.getCurrentPosition then a reverse geocode | Asks first | not counted | Yes |
| Postal code | navigator.geolocation.getCurrentPosition then a reverse geocode | Asks first | not counted | Yes |
| Address | navigator.geolocation.getCurrentPosition then a reverse geocode | Asks first | not counted | Yes |
| Timezone | Intl.DateTimeFormat().resolvedOptions().timeZone | None | 3 | Yes |
| Elevation | position.coords.altitude from getCurrentPosition | Asks first | not counted | Yes |
The line between asking and taking
Five of the six signals here go through the Geolocation API, which cannot produce a single coordinate until you accept a prompt your browser controls rather than the site. Refuse it and the page gets an error callback, not a degraded answer.
The sixth needs no prompt at all. Your timezone is read silently from the internationalisation API. Its unprompted cousin, the IP location estimate, lives one category over under Network, because it is derived from the address your request arrived from and nothing is read from your device at all.
That is why this site puts the consent-gated cards behind a button rather than firing a prompt on load. A prompt you did not ask for is a dark pattern, and on a site about surveillance it would be an especially poor one.
Two kinds of location, two very different accuracies
The consented reading comes from your device: satellite positioning outdoors on a phone, nearby wifi networks indoors, cell towers as a fallback. Accuracy runs from a few metres to a few hundred, and the API tells you which by returning a radius alongside the coordinates.
The unconsented estimate comes from a database of which addresses belong to which providers in which regions. Accuracy runs from good to comically wrong, and it tells you nothing about its own confidence. These two answers frequently disagree by tens of kilometres, and both are on this site so you can see that for yourself.
Turning coordinates into a postal code or a street name is a third step, and it needs an outside lookup: a map database has to be asked which area contains that point. On this site that request goes to OpenStreetMap Nominatim through our own relay, carrying only the coordinates you consented to share.
Why your timezone gives you away
Intl.DateTimeFormat().resolvedOptions().timeZone returns a name such as Europe/Amsterdam, not a number of hours. A name is a place. Nobody prompts you for it and no browser setting draws attention to it, so it sits underneath every session you have ever had.
It is also the classic VPN tell. Route your traffic through another country and your IP location moves; your timezone stays where you actually live. That contradiction is more informative than either signal on its own, and it is trivial to check.
Frequently asked questions
What happens if I refuse the location prompt?
The site receives an error and no coordinates at all. There is no partial answer and no fallback that quietly reads it another way. Everything else on this page keeps working, because none of the explanations depend on knowing where you are.
Is my timezone really a location signal?
Yes, and it is read without asking. The value is an IANA zone name such as Europe/Amsterdam, which names a place rather than an offset. It is the reason a VPN alone does not hide where you live.
How accurate is location without permission?
It is an estimate from your IP address, so it is usually right about the country and often wrong about the city. It carries no accuracy figure of its own, unlike a consented reading, which reports a radius in metres.