The USA is special in that there is no national law against the commercial exploitation of personal information. There is some state level legislation, but that can't help very much for this sort of thing.
None are exactly the same, but each includes many similar constraints to the GDPR, notably for the GP's point: no processing of personal data without consent. Together with the EU, those easily cover more than 50% of the global population.
I wouldn't be surprised if the US made an attempt at something similar soon. If not it feels like another area (see also: socialized healthcare, gun control, the metric system) where US norms could end up out of step with the rest of the developed world.
