As you rightly surmise, the operators can provide this information quite readily for phones that are switched on (cue rants from peeps saying you can pry my location from my cold dead hands, I'm only using the clacks for my personal communications now!).
As you move around the network, your phone is constantly telling the network where it is in terms of radio measurements of the cells around it. Each time your phone receives a notification, that's a data session that requires it to fully connect to the network to receive the data that indicates this. Having radio measurements of several cells will give you a pretty good idea of where the mobile is. Add a sprinkling of clever maths and the accuracy improves a fair amount.
This can be done for every phone in moderately near real time (*)
(*) - subject to server farm capacity relative to number of subscribers in the network and a bunch of other parameters too complicated to enumerate here, even if they were fully understood, and different vendors of such solutions offer different capabilities/accuracy
Biting the hand that feeds IT
