With GPS off, location can triangulated from cell tower usage to within 3/4 of a square mile (smaller uncertainty in urban areas where cell towers are closer together). I'd heard before that some data brokers do this, but in this article the writer mentions reverse DNS lookup on IP addresses, which they mention is less precise (ZIP-code level).