Uniquely identifying wifi MAC addresses and Bluetooth IDs can usually be passively picked up from phones. Correlate those with the other fuzzy identifiers you mentioned for even better and more versatile tracking.

I'm curious, are any MAC-like IDs broadcast plain-text as part of normal cell phone connections that could be passively sniffed? I must have the wrong keywords, but don't seem to be able to find anything on this.