The problem with GDPR is that most publishers see it as an IT/administrative burden. They think the only thing they need to do is set up some databases and do some other IT things ... and then redesign their privacy page.
What I'm not seeing, however, is any real change to the way publishers use data, the business models they have that rely on data, or any consideration as to what impact this will have on their editorial strategies.
The USA could create a law similar to GDPR; a law that would clearly state that residents and citizens have a right to determine how information about them is collected and used. Or we need infrastructure that would enable anyone to easily create and manage their own online presence but in a way that allows social sharing. Some of the very early foundations for that future is being set today.