[weaksauce]

They probably just see that you are using more bandwidth than a normal user and infer that way. If they were packet sniffing your non phone traffic they might be able to infer from a plethora of non phone headers that the system will invariably send out. (system update check in the background. Etc. )

[reemrevnivek]

In spite of all the other, technical ways of doing this (see your sibling comments), I fear that this is what they're doing.