There's no way anything resembling GDPR would pass in the United States, at least not in the next decade. Targeted regulations seem more likely to be feasible because they will be smaller and easier to get through negotiations and approved by the US House and Senate. (Not that I think even this sort of regulation would be easy with how things are right now)

Laws the size of GDPR in scope often take more than a decade here to pass - the ACA is a good example, and even after it passed there are still people fighting over whether it's valid and how it should be enforced, while other people are actively trying to repeal it. If we tried to handle something like facial recognition that way, the law would be useless because by the time it made it through the process and got put into effect the harm would already have been done.