Need I ask why the USA hasn't adopted a data protection law to prevent such shenanigans?

The only people objecting to the GDPR are scummy businesses who haven't yet understood that harvesting and/or selling personal data without consent is both not ethical and no longer a legal business model.