It's already gotten hit with the biggest-ever US child privacy fine, and now it might be facing a fine for GDPR violations.