Yes, even passive GPS devices may leak location data, but it is a bit complicated.
The RF signals sent from GPS satellites are unidirectional from the satellite to the earth. The RF receivers for those L1 and L2 bands require extremely precise timing information. This is because depending on your current location and the time of day, the GPS satellites available to those receivers changes. That is why older GPS devices and sometimes even modern devices need a "long time" (several minutes) to acquire the satellite.
The devices searches for up to four satellites in one of six different orbits. In each orbit a device typically sees one or two satellites. Determining which satellites are being received is critical to decoding the signal because each of the twenty four satellites uses a different code to send data to the receiver.
To make the acquisition time fast, many devices store information about the satellite's orbits to calculate what satellites are available rather than searching for each of the 24 satellites. This happens even in passive systems like hiking gps devices.
A examination of the ephemeris data (satellite prediction data) stored on even a passive dives gives a rough estimate of where the user has been recently. For example if a person used a GPS device yesterday south of the equator and then flew at least a few hundred kilometers north of the equator. An examiner may find evidence in the GPS device to prove that fact. This is because the satellites stored from yesterday would only have been visible from a location hundreds of kilometers south of where the user is today.