[mothered]

Alarming as It Is, It comes to no surprise.

Generally speaking, In terms of location (those not behind a VPN), the browser divulges your locality with either the browser's built-In geolocation feature, or when viewing a webpage that has JavaScript embedded In that page. In a lot of cases, the latter does not request permission, hence It's unbeknown to the user.

Cell Tower Triangulation has been around for a while and as mentioned In the Initial post here, the details/credentials obtained are significant.