What is 'browser geolocation API security' and what restrictions prevent silent location tracking?

• A.The Geolocation API (navigator.geolocation.getCurrentPosition()) requires: (1) Secure context (HTTPS or localhost - HTTP sites cannot access geolocation); (2) User permission prompt - the browser shows 'Allow [site] to access your location?' and the user must explicitly grant; (3) The permission can be 'Block' permanently or 'Allow once' or 'Allow while visiting the site'. Websites cannot access location silently. The Permissions Policy header (geolocation=()) can disable the API entirely for the page or specific iframes
• B.Calls to navigator.geolocation.getCurrentPosition() (the Geolocation API) require: (1) Secure context (HTTPS or localhost - HTTP sites cannot access geolocation); (2) A signed manifest from the site owner (the browser verifies the signature against the store); (3) The permission can be 'Block' permanently or 'Allow once' and 'Allow while visiting the site'. Websites can read location silently after the first grant. The Permissions Policy header (geolocation=()) can disable the API entirely for the page or specific iframes of the origin