Companies have been using data brokers to get info on potential employees for ages in violation of the law. The law has almost zero enforcement and when something is done nobody does to prison. It's almost always just the government wanting a cut of the action. For example:
https://www.ftc.gov/news-events/news/press-releases/2012/06/...
https://www.ftc.gov/news-events/news/press-releases/2014/04/...