the geolocation permission state matches what the call actually does
A denied permission produces PERMISSION_DENIED; a granted one produces a position or an unavailability, never a denial. A prompt state is left alone rather than probed.
What a detector infers
A deployed collector calls getCurrentPosition() behind a permissions.query pre-check and records which of PERMISSION_DENIED, POSITION_UNAVAILABLE or TIMEOUT came back alongside any coordinates. Both halves travel together, which makes their relationship checkable without any reference data: a permission the browser reports as denied must produce the denial error, and one it reports as granted must not.
They are two statements by one browser about one capability, so a disagreement means the permission surface is answering from somewhere other than the state the call actually enforces — the signature of a normalised permissions.query sitting above an unmodified geolocation service.
One reading is called out in the detail rather than scored: POSITION_UNAVAILABLE under a granted permission means no position provider answered, which is entirely ordinary on a desktop with no location hardware and is also exactly what a container with no location service reports. A collector reads those two the same way, so it is worth seeing, but it is not a fault.
The audit never calls through on a prompt state, because raising a permission dialog on a page someone opened for a measurement would be its own kind of rude.
How to resolve it
Report the permission state from the same place the call is gated on. A permissions.query result normalised independently of the geolocation service describes a decision the call does not honour, and the same collector reads both in one run.
Nearby checks in Environment & locale
- a live audio destination corresponds to an audio device that exists
audio-sink-vs-device-listA resource oracle, and deliberately a different resource from the voice list. - WebSQL (openDatabase) is absent for Chrome ≥ 119
opendatabase-removedWebSQL was removed from Chrome in version 119, so window.openDatabase should not exist on any newer Chromium. - BatteryManager fields satisfy the spec's mutual-exclusion invariants
battery-spec-invariantsThe probe calls navigator.getBattery() once and records four fields together: level, charging, chargingTime, dischargingTime. - enumerateDevices exposes audiooutput on a Chromium claim
media-kinds-vs-engineThe probe calls navigator.mediaDevices.enumerateDevices() and keeps only each entry's .kind, sorted — never labels or deviceIds, which is… - mediaCapabilities and canPlayType agree about the same codec
mediacapabilities-vs-canplaytypeTwo different APIs answer from the same platform decoder registry. - the intrinsic size of an undecodable image is reported
broken-image-intrinsic-sizeAn image that cannot decode still has intrinsic dimensions, and where they come from is the interesting part: the browser substitutes a… - the storage quota is reported against the JS heap ceiling it gets compared to
storage-quota-vs-heap-ceilingTwo published classifiers read the ratio between an origin's storage quota and the JavaScript heap ceiling, and — this is the whole point of… - how many ad-container class names are suppressed on this browser is reported
content-blocking-suppression-readoutA deployed collector injects a list of base64-encoded ad-container CSS selectors and measures which of them get suppressed, nominally to…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Environment & locale checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Environment & locale — the family geolocation-outcome-vs-permission belongs to.