Four people have started a class action lawsuit (pdf) against LinkedIn over its “reference search” function that allows anyone with a premium account access a list of references for anyone with an account—including other account holders who have worked for the same employer at the same time.

It’s pretty easy, just mouse over the arrow to the right of someone’s profile picture, click reference search, and you get a list sortable by employer. It’s ranked by how close the connection is and how often they’ve been recommended on LinkedIn. From there, you can contact them without the candidate knowing.

The lawsuit argues that the reference list falls under the Federal Credit Reporting Act (FCRA), a law that regulates reports used in hiring, and that LinkedIn has failed to meet reporting, accuracy, and disclosure obligations under that law.

In an emailed statement to Quartz, LinkedIn spokesman Joseph Roualdes writes, “We take member privacy very seriously. We believe that the legal claims in the recently-filed lawsuit are without merit, and we intend to fight it vigorously.”

He adds that the search only reveals people who were at the company at the same time as a member, and that “a reference search does not reveal any of that member’s non-public information.”

It might be surprising to some to find out their LinkedIn profiles are used in this way, but it looks to be just a simpler way for recruiters to do something they already do all the time: contact unlisted references in order to get a more thorough picture of a candidate.

People tend to provide references who think well of them, and whom they’ve likely informed about their job search—and recruiters tend to discount their feedback. Going beyond the reference checks provided by a candidate is extremely common hiring advice.

It’s one of several reasons you should always be nice to coworkers. If they happen to be a college buddy, acquaintance, or friend of a friend, they might one day be on a recruiter’s call list.

The complaint asserts that its plaintiffs have been denied employment due to the search function. The crux of the lawsuit isn’t about calling unlisted references, but if this particular service falls under the FCRA.

The law was originally designed to protect consumers who might be unfairly denied a job or mortgage because of potentially faulty information about their credit history. Agencies that produce consumer reports are regulated, and customers who use a report have to tell an applicant if they’re being denied a job based on it.

The complaint argues that the search fits the legal definition of these reports that they, “bear on a consumer’s character, general reputation, mode of living, or personal characteristics, and/or other factors listed in 15 U.S.C. § 1681a(d), and are used or expected to be used, in whole or in part,as a factor in determining the consumer’s eligibility for employment purposes.”

The potential issue (paywall) with the case is that all of the information LinkedIn uses is voluntarily provided, as opposed to a credit report or data broker report, where information is scraped from third parties and the internet. And LinkedIn merely provides a contact list, rather than actual data related to a candidate’s employability.