iOS and Android devices send a WiFi "ping" every so often - I believe this is done to improve locationing accuracy, by augmenting GPS data with WiFi signal strength data. You can read these pings from any AP, even if the device is not associated with the AP. You'll only get the device MAC, but that's enough to tell you the device make and get a unique ID on the customer.
And remember to turn off Bluetooth as well - the wifi and bluetooth MAC addresses are sequential - if you see one you know the other.
More paranoidly… A femtocell could fool your phone into revealing your phone number over the GSM/CDMA transmitter's channel. If I were involved in some extremely high value sale where the identity of potential purchasers was not always known, and where knowing it earlier might help close a sale (perhaps real estate or luxury cars?) - it'd be _so_ tempting to at least trial soemthing borderline-evil like that. (And now I'm inventing a small network of femtocells with directional antennas in white vans parked outside competitors - to track which of your potential customers are visiting which competitors…)