As you are aware, they are not supposed to ask. They may add it to your profile if you tell someone voluntary. They could also Google you or check your Twitter/LinkedIn/Facebook account.

In my case, the field remained blank until I checked in at one of the upper-tier subchains (one that lets you sit down to check-in). Shortly after settling in my room in I got a few "Your profile details have changed" emails from SPG. I checked my profile but didn't notice any changes. On my next check-in at another hotel, the field was filled in, and based on what was there I knew they got it from Google. I didn't tell them at check-in although they were definitely trying to get that information without directly asking for it.