I completely agree in terms of people saying FB 'listens' as in records audio.

But one thing people often overlook with hyper-local geo ads are bluetooth beacons which are tracked at most major retailers these days. Doesn't help that Apple trying to help people use wireless headphones now likes to turn bluetooth on every day (the lock screen bluetooth button defaults to 'off until tomorrow')

Combined with the fact that, as of the most recent version of iOS, "turning off" wifi or bluetooth in the quick menu just disconnects you from whatever network or device you're connected to, it doesn't actually disable either despite the visual indicators (and past behaviour) suggesting that they are disabled.

unpaired bluetooth and unconnected wifi are gold for anyone wanting to track you around a space.

I don't get it, how would you identifity someone with their wifi turned on ?

And bluetooth beacons (which you can get geo position without having to pair) are uniquely identifiable and used by almost all big box stores..

If the WiFi is on, you broadcast your MAC, which is uniquely identifiable unless you root your phone and install software to change this fact.

IIRC current android and iOS devices will probe Wifi using a randomized MAC and only use the real mac once connecting for realsies.

  researchers found that "the overwhelming majority of
  Android devices are not implementing the available
  randomization capabilities built into the Android OS,"
  which makes such Android devices trivial to track.
  [...]
  Apple, meanwhile, introduced MAC address randomization in
  iOS 8, only to break it in iOS 10. [...] its network probe
  broadcasts to include a distinct Information Element (IE),
  data added to Wi-Fi management frames to extend the Wi-Fi
  protocol.

https://www.theregister.co.uk/2017/03/10/mac_address_randomi...

  four scholars from the US Naval Academy say they've
  managed to track 100% of all test smartphones, despite
  the devices using randomized MAC addresses. 
  [...]
  The novelty in our method is that we are sending RTS
  frames to IEEE 802.11 client devices, not APs, to
  extract a CTS response message which we derive the true
  global MAC address of that device.

https://www.bleepingcomputer.com/news/security/researchers-b...

Don't forget the ultrasound-based tracking.

That's possible and maybe even is deployed somewhere, but I think it is still very unlikely to encounter it. We're overwhelmingly looking at ads that are targeted based on something obvious like zipcode and age.