I don't know what permissions an app might be using, but if they can access your wifi network they can read the names of the access points around you and feed them to massive databases that list every access point and what its location is to get a very good idea of where you are (within the distance of the range of your nearest wifi routers).

If it has access to bluetooth it can do the same thing, except companies also make heavy use of bluetooth beacons so that they have fixed points to log you at. The range on some beacons is so far that you couldn't even see them but others can log your location within a foot or so. Stores use bluetooth beacons to track where customers in their building walk, how fast they walk, what direction they go, where they stop, what they stop in front of, and how long it was until they started moving again. They can uniquely identify your device and keep detailed maps your movements over time.

If you give an app access to your camera they can see whatever is around you, scan your own selfies and pictures for clues, and even access your microphone. People have been able to get a location from ambient sound alone but there are also audio beacons that are used to track you which broadcast sound outside the range of human hearing.

Don't forget about the IP address.