Many data brokers aren’t registering across state lines, privacy groups say