Android - How does Google Maps estimate my location without GPS?

Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC Address of a access point that gets broadcast by that access point. It is therefore "publicly viewable" if the BSSID broadcast is enabled, which is the default for most access points. The BSSID operates on a lower layer than the IP stack; you don't even have to be connected to an access point to receive these broadcasts.

Every time you run Google Maps or Navigation with GPS and WiFi enabled and if your device is able to get a good GPS fix, the currently visible WLAN networks and your current location (the GPS fix) are uploaded to Google to build and update the database. This technique is sometimes called crowdsourcing. Every Android device acts therefore as data collector.

Since most access points are static in their position and only cover a small area - the coverage radius is approximately 100m - they are ideal anchors for a good location fix without GPS.