It is not against the law:
http://www.ftc.gov/os/statutes/fcra.htm#604
Section C has 5 parts that don't need your permission.
there must be a legitimate business need - as car dealers used to do this a s a matter of course - and the FTC has stated they can't under all circumstances, but neither must they get permission in all circumstances:
http://www.ftc.gov/opa/1998/9802/coffeypr.htm
"[A]n automobile dealer may obtain a report only in those circumstances in which the consumer clearly understands that he or she is initiating the purchase or lease of a vehicle and the seller has a legitimate business need for the consumer report to complete the transaction."
Nothing that reuires permission when the business need is clear. Just that the intention to purchase or lease the vehicle.
Plenty of places put it in their contracts, but that doesn't mean it is required.
--
They must give permission usually only in cases where it is used for employement or medical reasons:
http://www.ftc.gov/opa/1997/9709/fcra929.htm
Again - nothing requiring permission in all cases.
--
"Credit card issuers, likewise, often choose to notify applicants that a consumer report will be obtained, even though they are not required to do so."
http://www.ftc.gov/os/statutes/fcra/shibley.htm
--
Whether this would be a permissible purpose in this case is hard to say, but if it is - and not for a job or medical reasons - there is no general requirement of consent.