1. sample the HSS (HLR in old-money) every night to find which phones are camping in which location areas (LAC)s;
2. this given them a phone → area location for every phone in the country, where area is about 200 cells (a few km²);
3. then they could draw out the call detail_record (CDR) of very outgoing call, SMS, and even data session to get the cell identity;
4. this gets the phone → area mapping down to a few hundred m²;
5. then if they are motivated, they will use the location services in the Mobile Application Part (MAP) to silently move every unknown phone into dedicated mode and repeatedly determine its location to within 10m - 50m;
6. if the phone has control plane, GPS, they just ask it that. Many, many phones do;
7. this information is collected all the time and passed to in-house and 'external' GIS teams to cross-reference against all sorts of wonderful data;
8. they know who you are.
The good news is they don't care. They just want you to spend more. ARPU is everything.
Source: I built this stuff for a living.