WiFi as a location technology is well-known -- http://www.skyhookwireless.com for example has been selling this data for a decade.
What seems to be new here is that Android is very permissive and leaky with WiFi access point data, which allows an app to reverse-engineer location without specifically asking permission to know your location.
Your claim that Android scans for AP's even when WiFi is off is a very interesting one, which raises a lot of concern for privacy but also for RF interference -- if I say I want a radio to be off, then I expect it to be OFF, dammit!
What seems to be new here is that Android is very permissive and leaky with WiFi access point data, which allows an app to reverse-engineer location without specifically asking permission to know your location.
Your claim that Android scans for AP's even when WiFi is off is a very interesting one, which raises a lot of concern for privacy but also for RF interference -- if I say I want a radio to be off, then I expect it to be OFF, dammit!