A quote from Ashley, from this thread https://www.scirra.com/forum/gamepad-how-do-i_p754861?#p754861,
[quote:20y5ne3y]Browsers require that you press a button on the gamepad before it is recognised. This is for privacy reasons, so ad networks or malicious parties can't track you by using your available controllers as part of a fingerprint to identify you. If you never touch the controller it acts like it is not there.
I can't imagine why this would be a problem though. Just have a message on startup like "Press a gamepad button to use gamepad controls".