On A GSM network it works like this:

Each GSM tower location is known, either plotted during installation and fed in manually, or since each one has a GPS in it nowadays, they just turn it on and have it feed location data into the network. Also each tower has multiple sectors that it covers, usually three, but it can be more and in rare cases less. But It is like the tower being in the center of a pie, cut it into three equal slices and you get the gist. Directional antennas are used to keep the sectors more or less autonomous, though there is some overlap.

(Try drawing this out to make it easier to follow)

Now you have concentric rings around the tower, making it look like a big bullseye, these represent a timing advance. Since GSM uses TDMA, a digital nultiplexing technique in the time domain, you have to feed the handsets a psuedorandom number in order to overcome problems inherent with phones being different distances from the tower and using different time within the same RF frequency.

The network can have a specified handset re-authenticate on the network, this is something that happens all the time. When the phone authenticates on the network it is like the scene form "Horton Hears a Who" We are here, we are here.........

The network can then take the measurement from multiple towers within Line of Sight to the phone and correlate the tower location, sector and timing advance data from as many towers as can "hear" the phone. So now draw out severa towers with sectors and concentric rings and see where they overlap in space.

For a GSM network this is handled by the BSC or Base Station Controller.

Much easier to draw than it is to explain in text, but I hope ya'll can follow it.

Very different for CDMA or Analog systems, but pretty much the same for all TDMA multiplexed cell networks. (GSM, IS-136)