Indeed - it seems that this tracking is done completely outside of the phone, asking the network where, physically, the push notification was delivered (Tower, time, and date) to locate the phone and ostensibly the owner of the phone.