What is 'browser geolocation API security' and what restrictions prevent silent location tracking?

• A.The geolocation API is freely accessible by any HTTPS website without restrictions
• B.The Geolocation API (navigator.geolocation.getCurrentPosition()) requires: (1) Secure context (HTTPS or localhost - HTTP sites cannot access geolocation); (2) User permission prompt - the browser shows 'Allow [site] to access your location?' and the user must explicitly grant; (3) The permission can be 'Block' permanently or 'Allow once' or 'Allow while visiting the site'. Websites cannot access location silently. The Permissions Policy header (geolocation=()) can disable the API entirely for the page or specific iframes
• C.Geolocation is always available; the Permissions API only controls camera and microphone
• D.