If there were GPS coordinates blocks and direction of device blocks you could make really cool games similar to Pokèmon Go and also AR games.

 (GPS coordinates)

 (Direction of Device)

Of course, you also would be able to disable tracking like this.

forever
set [direction v] to (Direction of Device)
set [position v] to (GPS coordinates)
end

That's a little bit creepy for a website to have. How exactly would Scratch collect that data?

I think this would definitely lead to some hacker stealing someone's location. For example, let's say someone makes a project that saves your location to a cloud variable. They could easily find the exact location of where you where, and possibly track you down to the very house you live in. This would be catastrophic for scratch, because this is a huge safety concern.

Based on the project with ID 2, I'm also pretty sure that scratch was experimenting with something like this, but ultimately gave up on it for unknown reasons.

i could come up with many ways in theory to take advantage of that
and that's no joke (i won't seriously but it is possible)

Banana

This would probably be a major security issue, if cloud variables are involved, suddenly you could find a popular scratcher's almost exact location.

let's say i, say, made a root project, that is a project that people can remix (yay!) so that they could access some API via cloud data to get the user's location (boo). this project would contain a few scripts that let whoever wishes to store/leak location data do so. anything that isn't stored as numbers gets encoded, the username gets stored in one cloud variable in its encoded form, and hey presto, they get set as two separate cloud variables. i, the server developer, would use a client that would sign into scratch as a scratcher, and this, say, node.js client would sit waiting for cloud changes in those two variables. the data gets decoded and then stored in a database for, whoever. i might return it to someone who makes a request to my server for data, who knows. i could also set up a web portal for a user to say “hey, i want to register my project for tracking users' locations”, they enter the project id, and the server is listening on as many projects with cloud variables as there are stored in my database. this information could be leaked on scratch, or even worse, it could be leaked on the black market (or even sold who knows) or leaked to normal users, it could end up on some website. it's exploitable and it's not a good idea

Banana

Yeah, I agree - so long as cloud variables exist (such that the information could be communicated outside of the project), this would be a serious safety issue. Cool idea but not something I see us doing.