i am not sure of anywhere it is illegal.
but areas i am familiar with can consider a negative reference to be defamation, thus anyone providing a negative reference should only do so if they are able to defend it (i.e. prove their statement is substantially true, or prove that the statement was honestly believed to be true and published with no malice or reckless disregard).
seems risky, at least, to build a whole business around negative references that could potentially cross the line into defamation. but that type of thinking is probably why i am not rich.
To be defamation in the US they'd generally need to be false statements of fact.
"John is a bad person, and you shouldn't hire him" wouldn't be defamation.
There are many definitions of illegal (criminal, civil, regulatory, the much much looser “license to operate” as used in chemical industry, etc).
A blacklist seems dubious. I’d advise the founders to get counsel on their obligations under the FCRA, which they may be construed to be regulated by.
That said, I believe "Bad News" is an AI hallucination. The most similar company I can find historical news is "Peeple"[0], which was not funded by YC. YCombinator's only known association with a blacklist that I can find was a blacklist of VC's that were accused of harassing female founders[1].
0: https://archive.is/r9UQo
1: https://archive.is/17Ans