We need a GPDR for biometrics.
It seems the best the U.S. political system can come up with right now is "GDPR for X" where X represents only a few specific industries, because of strong entrenched special interests, lobbying and legalized bribery, which means strong gridlock and disagreement for a more "universal" law. Because the more industries the law would affect, the more billion-dollar corporations would fight against it with TV ads, lobbying and vote buying (sorry, I mean "campaign donations").
GDPR generally applies to all personal data of a citizen. The best I've seen from the U.S. government so far is the Consent Act, which applies only to online services only. It doesn't apply to ISPs, network providers, medical data, or a ton of other things it should apply to.
The more people realize that this "single issue" of taking money out of politics and drastically reducing or eliminating a corporations' influence on political decisions affects every other issue they care about, the better.