Privacy in the Geolocation Spec

I'd like to see some requirements around privacy. I agree that the W3C spec should not define the UI constraints for privacy, however I think the following guidelines should be present


*         The Geolocation API must not allow an application access to location data without user permission

*         The Geolocation API must allow the user to disable access to location data at any point