Actually, legally, they cannot say anything more than "He worked here from X to Y, that's all we can say". You don't need any agreement from them.
The First Amendment prevents this policy from being a law.
California, typically one of the hardest on employers, appears to have explicit protection for bad references made based on evidence and without malice. http://www.nolo.com/legal-encyclopedia/california-reference-...
New York's another high-regulation state, and while there's no explicit protection against defamation lawsuits, it's certainly not illegal to invite one via a shitty reference. http://www.nolo.com/legal-encyclopedia/reference-laws-new-yo...
I can't imagine a "no references" law would survive First Amendment muster in the US, regardless of attempted state legislation.