The French order is the first significant action to be taken against a company transferring Europeans' data to the United States following an EU court ruling last year that struck down an agreement that had been relied on by thousands of companies, including Facebook, to avoid cumbersome EU data transfer rules.
The transatlantic Safe Harbour pact was ruled illegal last year amid concerns over mass U.S. government snooping and EU data protection authorities said firms had three months to set up alternative legal arrangements for transferring data.
That deadline expired last week meaning regulators can now start taking legal action against companies still relying on Safe Harbour for approval to transfer data.
"Facebook transfers personal data to the United States on the basis of Safe Harbour, although the Court of Justice of the European Union declared invalid such transfers in its ruling of October 6, 2015," the French CNIL said in a statement.
Facebook has previously said that it does not use Safe Harbour as a means of moving data to the United States and has set up alternative legal structures to continue its transfers in line with EU law.
While the United States and the EU agreed a new pact last week to replace Safe Harbour, it is not yet operational and European data protection authorities have said they need more time to decide if transatlantic data transfers should be restricted.
Facebook said it was confident that it complied with EU data protection law.
"Protecting the privacy of the people who use Facebook is at the heart of everything we do. We ... look forward to engaging with the CNIL to respond to their concerns,” a spokeswoman said.
The CNIL said Facebook's tracking of non-users by placing a cookie on their browser without informing them when they visit a Facebook page did not comply with French privacy law.