It uses people who make requests to the server within a timeframe, perhaps 15-20 minutes, to determine the online counter. There's a timestamp that is updated when someone logs in and then randomly after that to avoid doing it on every page load.
____________
"On two occasions I have been asked,—"Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?" I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."
- Charles Babbage