A watchdog told Facebook that relying on developers to follow information rules in some cases was not good enough two years before a "data grab" on millions of users is said to have taken place.