How it works
In a browser, the Geolocation API (navigator.geolocation) asks the user for permission, works only on HTTPS pages and returns a latitude, a longitude and an accuracy radius in metres; watchPosition keeps updating as the device moves. On Android the Fused Location Provider blends GPS, Wi-Fi, mobile networks and motion sensors to balance accuracy against battery life, and on iOS Core Location does the same. Both let users share only an approximate position.
Accuracy ranges from a few metres outdoors with GPS to a whole neighbourhood from Wi-Fi or mobile networks alone, and is often worse indoors. Tracking in the background needs a separate permission and a clear reason, and app stores review it closely. Location from an IP address needs no permission but usually only gets the city or region right, which suits choosing a currency or language, not a delivery address.