According to ISO/IEC 15118-8:
If active scanning is used, the EVCC shall include a Vendor Specific Element as specified in Table … in its Probe Request frames.
NOTE 3 The Probe Request frame is described in IEEE Std 802.11-2012, 220.127.116.11.
Here is an example of how to do this with a recent version of iw, which is the modern version of iwconfig:
debian:/home/cvorg/hostapd-2.6/src/iw-4.14# ./iw dev wlx000f540ad921 scan ies dd:11:70:B3:D5:31:90:01:03:44:45:58:59:5a:01:23:45:67:89 dev <devname> scan [-u] [freq <freq>*] [ies <hex as 00:11:..>] [meshid <meshid>] [lowpri,flush,ap-force] [randomise[=<addr>/<mask>]] [ssid <ssid>*|passive] Scan on the given frequencies and probe for the given SSIDs (or wildcard if not given) unless passive scanning is requested. If -u is specified print unknown data in the scan results. Specified (vendor) IEs must be well-formed.