The author has introduced this pattern with ... "This makes sure that the stored data cannot be directly accessed from outside the context in which the WeakMap was defined." ... which makes clear that privateData lays within e.g the User.js module, thus it is protected by this module's local scope. The OP of cause could have provided the example code with module syntax to be even more clear about this matter, but then one can not just copy and paste the code into a JS -console.