Regulators took issue with the amount of personal data the company collected and its approach to consent.