every few seconds your phone (if not in airplane mode) will contact all base stations whiting in range and send a globally unique identifier to it. it doesn’t matter if the base station is for your company or if it’s fake (stingray). even if the tower does not give you access, maybe it’s not the company you’re a subscriber for, they still know you were in that area
It is true that your phone listens to control channel on currently selected base station. It is also true that your phone scans other channels relatively frequently to see if a better signal is available, but unless the phone decides (based on data received from the network) to switch to another base station, it will only talk to the network about once or twice per hour.
The network can ping the phone if it wants (and does so whenever there is something to be signalled, or if law enforcement decides to).