That's assuming the jurisdictions have the same rules as one another. If they have different rules, or conflicting rules, or rules that conflict with some other jurisdiction's data retention requirements, it becomes a huge mess.

And the probability of the US adopting the GDPR verbatim is practically nil.

Though I do have hope that there will be a common base that gives compliance amongst all regulatory areas.

Why would that be? AFAICT, this law merely sets standards for data brokers operating within the state of Vermont. It doesn’t try to dictate what anyone outside the state can do with data from people in Vermont, like GDPR does. Given Vermont’s size, my guess is that there are very few companies in Vermont that this law actually applies to.

Meanwhile, 'data broker' is defined as 'business' that engages in the brokering of data (obviously paraphrasing), where 'business' isn't bound by being incorporated in Vermont, but applies worldwide.

If a state in the US starts saying it has the power to regulate businesses in other states and countries, that would be news.

Also, please read the article we are commenting on:

Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense.

That is what this law does. Nothing more, nothing less.