Just like Santa Claus, they also know if you've been bad or good (so be good for goodness sake).
It's done through your ISP. They do it because it's the only way they can pay the music royalties for the stream.
The location data is collected from an IP address/location database the ISP has, relating the block of IP addresses a local ISP dishes out to customers to a location. Some ISPs log location down to the city block. But it has nothing to do with royalties for the stream. Music licensing is purchased by stations from a Performing Rights Organization, and is based on what the station plays and ultimately the size of the audience. OTA and streaming licensing are not the same for most PROs, and must be dealt with separately. Location has little to do with it, if anything, other than the location of the station being tied to what PRO it has to work with. In the USA there are 4 PROs.
Listener statistics like time of connection, total connect time, bit rate of the connection, device and OS type, etc., including location data, is collected and logged by stream providers and stations can access that information, usually via their account web GUI. It's useful in determining the streaming audience size and location from a sales standpoint, if the stream audience is significant (which it usually isn't, compaired to OTA). Music licensing is more complex, but location isn't really the problem. Mostly licensing is a problem of logging what was played when, vs using some sort of blanket license. Again, separate licensing for OTA vs streams, but it's the same kind of data.
Localized ads are inserted by the stream provider (Audacy, TuneIn, etc.), triggerd by metadata on the station's original stream, and localized based on the connected listener's ISP location data. The stream provider performs these ad insert/replacements under contract with the station in question, with a kickback being owed to the station for the privilege of replacing the stations spots with their own, which the stream provider sells to their adveritising customers, often for quite a bit of money. They also sell pre-rolls, and if no spot-break metadata is provided, they'll sometimes contract for random mid-rolls too, which are just plain crude, as well as banners on devices with full or partial web browsers. Some audio stream only devices won't get those of course.
From a techical viewpoint, pre-rolls, mid-rolls, and insert/replacements often have level-match issues with the station's stream, and with each other. They also suffer from a bit of delay between the spot-break start metatag and the inserted spot's start, making for clumsy sounding breaks, upcuts, etc. But if the station gets paid for all of that, hey, they don't care much. But it does open a discussion about stream levels and stream loudness processing for which there's simply no standardized solution.
In the future, this level mismatch issue may become more of a concern if/when the "pushbutton Internet radio" makes it into the dashboard. Which it has to, because fiddling with your phone to change streaming station is eventually going to get you wrecked. When streaming in the car is the norm, this level thing will have to get fixed.
Anyone can use a software VPN to reset their location data to anything they wish. I personally use ExpressVPN, mostly for testing how sites and devices "look" to other locations and countries. If you want to check to see that your firewall will actually block access for requests from certain...um...undesirable countries to your transmitter's web GUI, you can check that. It's pretty informative. It is a Spy vs Spy game, of course, because if We can use a VPN, so can the bad actors. But it's also useful for accessing material on sites like YouTube that get blocked to certain locations. You can step right around that block with the VPN. ExpressVPN will run on any OS, including smart phones. More sophisticated VPNs will let you set your device type, or specific browser type too.
I'm not promoting ExpressVPN, I just use it because it solves a problem or three for me quickly and easily, and I have so many other problems to solve. I'm sure there are better solutions that cost less.
