They did write data privacy laws when they banned TikTok. Read HR 815 Division H and Division I of 118th Congress, which is just HR 7520 and 7521 bundled into a larger bill.

The original text of HR 7520 is:

(a) Prohibition.—It shall be unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to—

(1) any foreign adversary country; or

(2) any entity that is controlled by a foreign adversary.

(b) Enforcement by Federal Trade Commission.—

(1) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of this section shall be treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

(2) POWERS OF COMMISSION.—

(A) IN GENERAL.—The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section.

(B) PRIVILEGES AND IMMUNITIES.—Any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.

(3) AUTHORITY PRESERVED.—Nothing in this section may be construed to limit the authority of the Commission under any other provision of law.

Definition of Foreign Adversary:

“(4) FOREIGN ADVERSARY COUNTRY.—The term “foreign adversary country” means a country specified in section 4872(d)(2) of title 10, United States Code.”

Which states:

“(2) Covered nation .— The term “covered nation” means— (A) the Democratic People’s Republic of North Korea; (B) the People’s Republic of China; © the Russian Federation; and (D) the Islamic Republic of Iran.”

But I think it also includes a few other countries, idk if this text is up to date.