Without your authorization to pull your crediit file I think they broke the law when they pulled it. Also, at some point they would need to have your SS# in order to get it. If you did not sign an authorization, than I suppose you could report them to the Attorney General of the state you were in.
There has not been much enforcement of these laws in the past and some car dealers are constant abusers.