I've witnessed quite a lot of them using IR-based beacons installed on the ceiling, as well as a few of them that use an expansion slot on certain Cisco APs to

I've witnessed quite a lot of them using IR-based beacons installed on the ceiling, as well as a few of them that use an expansion slot on certain Cisco APs to piggyback a transmitter to change tags.