Yeah, many of them use already bluetooth beacons. You don't even need to connect. They use signal strength and UUIDs to know your proximity and identity, then this is tied back to all the information harvested from other sources to profile you.

All of this should be illegal. But, until Congress grows some balls and passes actual privacy laws, this is another good reason to keep bluetooth, wifi, NFC, and other modes of transmission off on your phone unless you're specifically using it for something at that moment.