The server the app is communicating with can see the IP address of the user, which may be enough to uniquely identify multiple users connected on the same network.

But yes, both iOS[1] and Android[2] have APIs for accessing the name of the connected wifi network. Access depends a bit on how old your OS is and what permissions your app has.

And even if you've locked down permissions for the facebook app, you might have a different app which includes an SDK that slurps up the wifi name, GPS, signal strength of nearby wifi networks, connected cell tower info, and nearby bluetooth devices. That info gets sold to a data broker, which facebook may buy to hit you with an ad for whatever your mate just googled on the other end of the couch.

[1] https://developer.apple.com/forums/thread/679038

[2] https://stackoverflow.com/questions/21391395/get-ssid-when-w...

Bob searches for "new Ford car" on Google, Dave is sat next to him in the pub, he opens up his Facebook, and sees an ad for a new Ford car.

The hotspot isn't sharing anything, but the apps are putting data together. Google says "This IP is looking this up, and the tracking matches one of your users" (Or maybe they just firehose searches for relevant terms? I dunno.) Facebook app sees that, then sees that Dave is also using that IP for his Facebook app, put together with a list of Bob/Dave's friends and IP's, it's a high probability that they are talking about it currently, so show Bob's friends nearby that ad.