The established rule, as far as I know, is that a private business can do something, like banning people, unless there is a law against it, such as one protecting a specific class of people.

Is that not how it works? Is everything illegal until a regulation specifically allows it? Should it be?