Yeah, honestly, GDPR isn't perfect legislation, but it's pretty close. You could just copy-and-paste GDPR into the US and, with actual enforcement behind it, most of the egregious violations would be fixed pretty quickly.