Yeah this is borderline. It probably won't fly in California. In the past big tech companies (like Symantec) used to require you to submit your last W2 or tax return for a job offer. Credit card companies also sell your salary information etc...