> Google reportedly used their Android users to sniff APs

Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least.

https://github.com/acheong08/apple-corelocation-experiments