The GeoLocation API can find a user's location from a variety of information sources, using the best available. The W3C specification states:
The Geolocation API defines a high-level interface to location information associated only with the device hosting the implementation, such as latitude and longitude. The API itself is agnostic of the underlying location information sources. Common sources of location information include Global Positioning System (GPS) and location inferred from network signals such as IP address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input. [From dev.w3.org/geo/api/spec-source.html#introduction]
If GPS is available, it will be used (though some devices, because of the delay and high energy use of GPS, opt not to use GPS). If GPS is not available, A-GPS (Assistive GPS, triangulated from cell phone towers), WiFi, IP, or another less accurate means of locating the user will be used.