They give it to a third party - other chrome users. I was once in a train, and location services located me in a suburb hundreds of km away - clearly I was traveling with someone living there, using a portable/mobile hotspot. These kind of edge cases are hard to prevent (and rare), but still can lead to serious fines.
Which part of GDPR would prevent Google from collecting pairs of (Wi-Fi BSSID, approx lat/lon), with the consent that you gave when you set up your Android phone, and using it for their own purpose without giving it to any third party?