It's probably not cookie-based, or not only cookie-based. Browser fingerprinting and user profiling have gotten very sophisticated, and don't think the big 4.5 aren't using these techniques extensively.

It's probably still cookie based.

If one logged into Amazon in both browsers then it is really just linking to the account (even after logging out).

How could IP-based possibly work for people at places like college campuses?

They take the number of people from the same IP into account. IPs are broken down into public IPs vs private IPs based on traffic/timing of usage etc. There are research papers on this sort of feature contruction using only IPs. Cross device especially uses it extensively to be able to probabilistically ascertain if the person from your house who is checking their phone is the same person who checked smth on the Desktop computer last night based on your online timing, IPs, behaviour over the day. They can figure out, for instance, your office vs home browsing timing, interests etc with the same methods.

Interesting. Do you have the links of these papers so that I can read more?