With GPS off, location can triangulated from cell tower usage to within 3/4 of a square mile (smaller uncertainty in urban areas where cell towers are closer together). I'd heard before that some data brokers do this, but in this article the writer mentions reverse DNS lookup on IP addresses, which they mention is less precise (ZIP-code level).
Only if you don't turn WiFi off. To my understanding even the "soft off" option present in iOS stops the phone from beaconing, and just listens in order to collect data for building augmented location services. I don't know what the Androids do. These days both of them also offer randomized MAC address to curtail such tracking.
