W3C Geolocation API is built on existing technologies, and is heavily influenced by Google Gears Geolocation API. In fact, Firefox's Geolocation implementation uses Google's network location provider.
Google Gears Geolocation works by sending a set of parameters that could give a hint as to where the user's physical location is, to a network location provider server, which is by default, the one provided by Google (code.l.google.com). Some of the parameters are a list of mobile cell towers and their signal strengths, as well as a list of detected Wi-Fi networks and their signal strengths. These parameters are encapsulated into a JSON message and sent to the network location provider via HTTP POST. Based on these parameters, the network location provider can deduce the location.
"If you allow a website to get your location via this service, we (google) will collect, depending on the capabilities of your device, information about the wifi routers closest to you, cell ids of the cell towers closest to you, and the strength of your wifi or cell signal. We use this information to return an estimated location to the Firefox browser and the Firefox browser sends the estimated location to the requesting website. For each request sent to our (google) service, we (google) also collect IP address, user agent information, and unique identifier of your client. We use this information to distinguish requests, not to identify you."
Sources : http://www.google.com/intl/en/privacy/lsf.html and http://en.wikipedia.org/wiki/W3C_Geolocation_API