I'm a big fan of the GDPR and it certainly improved things over here across the pond, but "pass a GDPR clone" isn't something that leads to progress. There's a

I'm a big fan of the GDPR and it certainly improved things over here across the pond, but "pass a GDPR clone" isn't something that leads to progress. There's a lot of stuff that can be improved about the GDPR, and there are a lot of other options as well -- for example, in this case, the US could choose to extend the coverage of HIPAA regulations (or a subset of them) to commercial entities selling health-related services, not just medical providers. This would also have the advantage of requiring less legal effort and it would avoid introducing an entirely new framework. The GDPR is a very broad axe, for an organization that isn't a federation and doesn't have a real federal government, the way the US does. The US has legal options and a legal framework that we don't have.