I think as long as they follow something similar to the guidelines in [1] they will be fine -- having good reputation information is too valuable to make illegal.

[1] http://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act