Location permission not triggered on page load without user action

Triggering a geolocation permission prompt on page load — before any user interaction — violates GDPR Art. 5(1)(b) (purpose limitation and data minimisation) and ePrivacy Art. 5(3), which require that access to device capabilities be tied to a specific, user-initiated purpose. Browsers increasingly penalize automatic permission requests by pre-denying them, meaning an auto-triggered geolocation call trains the browser to block your site permanently. Beyond compliance, an unexpected permission dialog on load is a hostile UX pattern that signals your site does not respect user agency — a trust-damaging first impression for a directory product that depends on repeat engagement.

Remove any navigator.geolocation call from component mount effects and ensure the call is made exclusively in response to an explicit user action such as a button click.

// WRONG — fires on mount, before any interaction
useEffect(() => {
  navigator.geolocation.getCurrentPosition(handleLocation, handleError);
}, []);

// CORRECT — fires only on explicit user click
function MapComponent() {
  const handleNearMe = () => {
    navigator.geolocation.getCurrentPosition(handleLocation, handleError);
  };
  return <button onClick={handleNearMe}>Find Near Me</button>;
}

Search src/ for all navigator.geolocation call sites and confirm none appear inside useEffect with an empty dependency array or any top-level component body. Audit both the map component and any location-aware search components.