Facebook has been ordered to stop tracking non-Facebook users in France, or else it could be fined by the country's privacy watchdog.

The Mark Zuckerberg-run company has been given three months to comply with the order, which comes a week after a deadline for the US and EU to agree to a replacement to the "invalid" Safe Harbour pact lapsed, and a "political deal" was fudged by officials who were keen to buy more time for their negotiations to continue before regulators swooped.

French data regulator CNIL (the Commission Nationale de l’Informatique et des Libertés) said in a statement on Monday that it had it issued its formal notice against Facebook, demanding that the multinational changes it practices in light of "several failures" to comply with France's Data Protection Act.

Facebook needs to stop some of its transfers to the US, the watchdog added, by noting that the European Court of Justice had ripped up the Safe Harbour agreement in October last year. Concerns—following an on-site inspection, and documentary audit—highlighted by CNIL included:

Facebook collects, without prior information, data concerning the browsing activity of Internet users who do not have a Facebook account. Indeed, the company does not inform Internet users that it sets a cookie on their terminal when they visit a Facebook public page (e.g. page of a public event or of a friend). This cookie transmits to Facebook information relating to third-party websites offering Facebook plug-ins (e.g. Like button) that are visited by Internet users.

The social network collects data concerning the sexual orientation and the religious and political views without the explicit consent of account holders. In addition, Internet users are not informed on the sign up form with regard to their rights and the processing of their personal data.

It also concluded that Facebook—which is used by 30 million people in France—had failed to adequately inform and obtain consent of Internet users, before setting cookies on the website, and claimed that account-holders did not have access to tools to prevent a compilation of their data that is then used by advertisers, thereby violating their "right to respect for private life."

Facebook rejected the complaints, however. "We are confident that we comply with European Data Protection law," a spokesperson at the company said.

On the day that the Safe Harbour pact was deemed invalid, on October 6, Facebook claimed that it used other methods to transfer data to the US from European. It said at the time:

Facebook, like many thousands of European companies, relies on a number of the methods prescribed by EU law to legally transfer data to the US from Europe, aside from Safe Harbour.

Late last year, Facebook was forced to temporarily comply with an order from a Belgian court to stop tracking people who don't have accounts on the service.

Facebook said it would appeal against that ruling, but agreed to the demands in the interim to swerve daily fines of €250,000 from the Belgian privacy authorities.

Dutch, Spanish, and German data watchdogs have also been sniffing around Facebook's business practices, as part of a pan-EU probe—alongside France and Belgium—to tackle the company's huge data-hoarding practices.