[mothered]

I'm not quite sure about this, but I think even if you choose to disable the GPS feature it's still going to work.

Even with GPS disabled, both the Magnetometer & Barometer sensors can track your location.

That aside, If there's a (malicious) JavaScript code that's embedded In a webpage that you're viewing, It allows your browser to estimate your location and the Information Is sent to the website's servers- all without your permission.
Moreover, the browser's built-In geolocation feature (found In all major browsers) that uses the HTML5 Geolocation API, can also obtain your location however this does require your permission. Typical behavior of this, Is when a popup comes up with a message of "www.example.com wants to know your location". A lot of users simply click OK without thinking which Is certainly not good practice.