In the US in particular there are nearly no data protection laws (except healthcare records). So companies "share" data with impunity.
[0] https://stackoverflow.com/questions/1996106/how-does-ip-geol...
I integrated that into my own webserver so I get fun logs; there's a tingle when you see people reading your own posts after all.
You can also buy a bigger, better DB from the same people.
If the question is how someone like maxmind or others assemble that data it is usually done through a mix of ARIN, data aggregators and ISP data. ARIN will give which ISP and which country it is assigned to. ISP's generally have blocks regulated to specific areas of the country, e.g. mine is "RR-SOUTHEAST-BLK2", as I am on brighthouse, and that block has 67.8.x.x in it. And data aggregators purchase data from ecommerce and other sources to gather location data on individuals and their IP's. This is then aggregated, split and sold in many ways.
There are also some companies/startups working on GEO location to be able to target a person on any device based upon knowing the IP's they have used and some algorithms around the user-agent of the browsers etc. This means they can target you with marketing based upon who you are and your purchase history.
*EDIT: As for lat/long, ZIP codes in the US have a centroid lat/long as assigned by Tiger data (and others). So they will use that as a starting point, and if an aggregator has purchased your data from someone they may be able to get the lat/long even closer through the matching algorithms.