See How does Google know where I am? from SE security for good answers on this. Reproducing key extracts here:
Each cell tower has a set of ID numbers that identifies them to the phones. It broadcasts its identity constantly so that phones can connect to it as they move around....If you're in a larger populated area, like a city, your phone will usually get signals from more than one cell tower....
So how does Google know any of where these cells, wedges, slices, and intersections are?
From the billion Android phones that have GPS turned on (including yours, when your GPS was on), constantly sending reports of their GPS location and what cell towers and signal strengths they see. Google has used this data to map out where each cell is located, and what the approximate signal strength is at each point. They have a giant database on their servers with this information; your phone queries that database by making a network request that lists all cell towers that are in range, and the Google servers respond with your estimated location.
- From BSSID information from your WLAN Access point even if your GPS and Wi-Fi are turned off.
See INV3NT3D's answer
Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a access point that gets broadcasted by that access point. It is therefore "public viewable" if the BSSID broadcast is enabled, which is the default for most access points....So, essentially, when you ARE using WiFi and GPS, Google's database of BSSIDs is updated with a geographic location associated with that BSSID....So it's not that the ISP is giving Google the location of their routers, it's that your phone has already helped to build a database of the Access Points around you, and Google uses this data for geolocation.
So, you are pretty much tracked all the time and more accurately perhaps when your GPS is on and you are in a Wi-Fi dense environment (did you notice that your map location accuracy is much better while traversing a business or shopping area? )
Coming to other points in your question, tracking is periodic and I doubt if the frequency of updating would be available in public domain ( my assumption and open to correction )
Coming to the legality, this SE site doesn't deal with it but I am sure when you tick I agree on activating the device, you would have agreed to this ( Who reads them anyway? )