Did they get consent?
https://www.kelleydrye.com/viewpoints/blogs/commlaw-monitor/...
Also another article I read says the CIPA has a civil statute $5,000 per violation, so if you're Meta, who cares. Not exactly the federal Computer Fraud and Abuse Act.