'Privacy nightmare': 19 states fight SEC's investor tracker