Their contracts with the carriers allow for remote pings of the GPS chip (if there is GPS on the handset). Otherwise it's just cell tower triangulation.
It is 100% opt-in, but there is no "app" needed on the actual phone - so you're totally right if by "per app" you mean "per developer" or "per use case." So I might allow one company to locate my phone for a family-finder scenario, and another company to locate my phone for local weather alerts, for example. No app required in either case. Hope this helps.