She noted that the company was potentially violating the General Data Protection Regulation (GDPR) which requires the company to provide different services and different protections for children.[187]