I was more so mocking the security theater in the GDPR, but now I see your frustration with how activism works in EU policy making.
Because of the circumstances under which the USA was federated, we have done pretty strong systems in place to prevent local activism from having a national impact.
It doesn't prevent the federal government itself from surveiling the population (e.g. the Patriot act and everything descending from it) but at least if something is legal in a state, companies in that state can generally transact with residents of any state. (for example: https://en.wikipedia.org/wiki/Marquette_National_Bank_of_Min....)
Because of the circumstances under which the USA was federated, we have done pretty strong systems in place to prevent local activism from having a national impact.
It doesn't prevent the federal government itself from surveiling the population (e.g. the Patriot act and everything descending from it) but at least if something is legal in a state, companies in that state can generally transact with residents of any state. (for example: https://en.wikipedia.org/wiki/Marquette_National_Bank_of_Min....)