horde I'd suggest reading this section of the website: https://grapheneos.org/faq#cellular-tracking
It has many quotes like the following:
Cellular networks use inherently insecure protocols and have many trusted parties.
Quickly skimming through the article, it seems the information is sent as part of a GET request. I don't know specifically what GrapheneOS sends, but I'd imagine they're using something generic (or haven't changed the original value) like they do with the connectivity checks.