Poor privacy protection in the states