And if the user withdraws their consent (clicking "No", DNT headers, etc.) that should be the end of it. Don't locate, don't track, don't subvert user's consent.
Just flag it as "no location information available" if you need to use it for an access control/fraud prevention mechanism and be aware that determined bad guys can spoof almost every signal you receive from them.
