It's opt-in--definitely no way to get a locate without a device owner providing permission to do so. It's kind of like a Facebook app, if you're using a service that uses Veriplace to get location information, any end user can log in and modify (or deny) what information that service can access. Location data is only stored as specified by your Veriplace settings and otherwise isn't kept around.

Veriplace is a location aggregator (for details, see http://developer.sprint.com/site/global/go_to_market/aggrega...). Essentially, every carrier has a disparate location infrastructure that would require significant development and customization to integrate with. Simply too much work for most developers. Veriplace and other aggregators provide a much simpler, singular API for accessing location data across multiple carriers.

To be clear--these companies are tightly regulated and strictly watched over by both the government and the carriers. It's not these services that should be the concern, it's more so data retention policies and what not of carriers where the data originates.