Summary

  • The 2012 Gamepad draft offered browser games direct access to controller buttons and axes. A gamepad pretending to be a keyboard or mouse lost information and needed extra software.
  • The 2025 W3C draft withholds the connected-device list from a page until a real gamepad gesture is observed. The rule limits passive device discovery; Permissions Policy supplies a separate gate, and a random stick tremor should not ring the bell.

The player plugs in a controller and opens a game. A keyboard can tell the page that a key went down; it cannot faithfully describe how far an analog trigger was squeezed or which way a stick leaned. A mouse cursor is no better at speaking steering wheel. The W3C's first public Gamepad draft in May 2012 set out to make that translation unnecessary. It gave scripts a low-level picture of a controller: axes, buttons, an identifier, an index and a time when state changed. It also described connection and disconnection events. The game could speak to the hardware in its own vocabulary, instead of asking the controller to cosplay as office equipment.

The early model was deliberately mechanical. An axis ran from -1 to 1; a button from 0 to 1. A halfway pressed trigger could be a halfway pressed trigger. The id string could tell an application what kind of controller it had met, while an index kept track of several pads. Those fields are useful when four people are sitting on a couch and only one has paused the game. They are also a small census of equipment. A page that can ask for the list before the game begins learns something about the visitor even if the visitor never plays.

This is the moment where the controller itself supplies a better introduction. The 10 July 2025 W3C draft says navigator.getGamepads() returns an empty list until a gamepad user gesture has been seen. The document explicitly names fingerprinting as the reason. Hardware may be connected; the page simply does not get the inventory yet. Press a button or move a self-centering stick intentionally, and the browser can expose the pad. It is the player's action, not merely the site's curiosity, that starts the conversation.

Writing that rule takes more thought than drawing a doorbell. Some controllers have switches that stay on. Some sticks drift a little around their resting point. A held toggle or random jitter should not qualify as a fresh human greeting. The 2025 draft therefore asks the browser to recognize a move away from a neutral state: a button normally released becomes pressed, or an axis with a resting position moves past a threshold after having been near neutral. The detail prevents a defective spring from introducing the player to every webpage in town.

There are other doors. The same draft tells getGamepads() to return an empty list for a document that is not fully active. A page denied the gamepad Permissions Policy feature gets SecurityError. A user gesture is an exposure condition; it is not a ceremonial grant of every privilege to every embedded page. The browser still decides which document may use the feature, and the application still decides how to interpret the buttons. One piece of hardware, several distinct decisions.

After the introduction, a game needs timely snapshots. The getGamepads() array reports connected, interacted-with controllers, with null where an index no longer has a device. Connection events tell an application when a pad arrives or leaves. The index is bookkeeping, not an eternal identity; the draft can reuse an opening after a controller is unplugged. Meanwhile the button and axis values carry the immediate action: jump, turn, brake, or scroll a living-room interface from the couch. The API gives the application the motion, not the plot of the game.

The W3C publication history begins with that 2012 public draft and runs through the 2025 version. Those dates chart the documents, not the day every browser adopted the same behaviour. The arc of the design is plain enough without a universal release date. Browser games needed honest controller input. Browser privacy needed a way to stop pages from quietly taking attendance among plugged-in pads.

The player finally presses a button. The game sees a controller and the character moves. The webpage got its introduction at the right time: after the person holding the device rang the bell.