Android - Do Android devices make active or passive scan when looking for WiFi AP
The only "official" explanation I found is in this comment (dated July 2009) in the Git repositories on android:
wifi: WifiManager.startScan() will now do passive scans by default.
Active scans will only happen if an hidden AP is in use, or if the new method WifiManager.startScanActive() is called.
The existence of an hidden function to start an active scan (reported here) suggests that the normal scanning function is indeed passive. This is to be taken with a grain of salt, though, as the Android documentation doesn't explicitly tell if the function WifiManager.startScan() is passive or not.
Also related: this two posts on SO (post 1, post 2) report that the scanning activity is passive (post 1) and that since android 4.3 it not even possible to call the active scan method (post 2) - but there is no link to official sources.