Regulators said Meta had not secured 'specific' consent