Tower info plus other sources. A while back I couldn't stop my iPhone from connecting to the 'free' Orange WiFi at my mall.
Since signal is weak I enabled 'WiFi calling' which also shares location info with the carrier (so they know if you are roaming or not, presumably).
