The short answer
A website normally receives your public IP and request headers, while JavaScript can read browser, display, language, time-zone and capability signals. Exact GPS, camera and microphone access use separate permission prompts.
Information visible during a normal visit
The server needs a return address for every connection, so it receives the public IP used to load the page. Request headers can describe accepted languages, browser compatibility and other protocol details. Browser APIs add screen, time-zone, storage and device-capability signals.
Most of these values exist so websites can deliver the right language, layout and features. Visibility does not mean a site automatically knows your legal identity or that your device has been compromised.
Approximate location versus exact location
An IP address can be compared with network-registration and geolocation databases to estimate a country, region or city. The estimate may point to a provider gateway or nearby city and should not be treated as a street address.
Precise device location normally requires a browser permission request. If you grant it, the result can use GPS, nearby Wi-Fi and other sensors and may be much more accurate than IP geolocation.
How browser fingerprinting changes the picture
One common value such as language or screen size identifies a broad group. Combining many values—browser version, display, time zone, graphics behavior, fonts and feature support—can create a more distinctive profile even without traditional cookies.
Privacy-focused browsers reduce or standardize some signals. A trusted VPN changes the public IP seen by websites, but it does not automatically hide browser characteristics, account logins or information you submit yourself.