You can also be tracked via local wi-fi access points. Google has built a database mapping access points to GPS coordinates. All they need is access to wi-fi information and they can find your location even if you have GPS and 4G disabled. There is really little you can do nowadays to protect your privacy.

This was actually how the very first iPhone did it’s location tracking when it didn’t have a GPS chip in it.

Uh..stop using Google..?

Every baseband (cellular chip) is mandated closed sourced, and likely backdoored.

Open source basebands NOW.

The main point here is that they're doing the tracking with a typical user mode application without access to anything that a user would know is giving away their location.

Tracking location with other sensors requires more permissions.

Can't you remove your battery?

Bingo !