Phantom_M3sh's journey

I just had a really stressful experience during my job search. About three weeks ago, I applied for a mid-level analyst role and went through three rounds of interviews, feeling pretty confident about my chances. I made sure to check the box that said 'do not contact my current employer' on their application because my team has no idea I'm looking to leave. Today, I walked into the office and my manager called me into a conference room. He closed the door and asked why a third-party screening agency had contacted our desk to verify my tenure and get managerial feedback. I was completely outed before I even received an offer letter! I immediately emailed the recruiter to ask what happened, and she replied that their system triggers verification once a candidate reaches the final stage, which is apparently standard protocol. Now, my boss looks at me like I've betrayed him, and I'm worried I might not get my bonus this quarter. I really regret trusting their application portal. How is this even legal?