I don't know how to sniff their communications to find out how this is done.
For an Android handset, enable Developer Mode, and then go to Settings --> Developer options --> Enable Bluetooth HCI snoop log. Stuff should then be written to /sdcard/Android/data/btsnoop_hci.log which one can pull off later and feed into Wireshark (on a PC) for analysis.
I have not actually tried this, but others have. The exact pathname may vary, but the file itself is always called btsnoop_hci.log