The top US data privacy regulator has accused Meta, the firm that owns Facebook and Instagram, of not putting proper parental controls in place.