If they process personal data without explicit user consent, in violation of a privacy policy that outlines the types of data collected and how it is handled, it could be a GDPR violation. For example, if I cast photos of my children via Chromecast or entered my email into a Netflix app, and they send those images or my email sent to a server without my consent, this might also constitute a GDPR violation. It would be great if Max Schrems or a similar privacy advocate took up such a case.