France's data protection authority this week gave Facebook an ultimatum: Stop tracking non-users' Web activity without permission, or pay up.
A 17-page order by the Commission Nationale de l'Informatique et des Libertés (CNIL)—dated Jan. 26, but published on Monday—said the social network must change its ways (aka stop using cookies to collect info for ad purposes without permission) or face penalties of €150,000 ($168,000).
CNIL also ordered Facebook to stop transferring personal data to the U.S., following the repeal of the Safe Harbor deal.
Established 15 years ago to ensure businesses treat data moving between countries with the same privacy protections as inside the region, the Safe Harbor deal came under fire following mass surveillance revelations in the Snowden documents. In October, Europe's high court ruled that it was invalid.
In November, the European Commission said it would wrap up discussions on a new deal within three months—i.e. February 2016. But, as Reuters reported, the deadline expired last week, meaning regulators can now take legal action against companies still relying on Safe Harbor.
Shortly after the invalidation, Irish officials said they would investigate Facebook's data practices. Now, CNIL has jumped in, making its order public this week "due to the seriousness of the violations and the number of individuals concerned by the Facebook service," which is used by more than 30 million people in France.
"Protecting the privacy of the people who use Facebook is at the heart of everything we do," Facebook told PCMag. "We are confident that we comply with European Data Protection law and look forward to engaging with the CNIL to respond to their concerns."
According to Reuters, Facebook says it uses methods allowed under EU law to transfer data, not safe harbor.
Last month, Facebook opened its first data center in Ireland, which could come in handy if a safe harbor deal is not reached.
France is not the only country that has tangled with Facebook over privacy, though. Last year, the Belgian Privacy Commission, working with Dutch, French, German, and Spanish authorities, accused Facebook of breaching European privacy laws. In December, the company said it would comply with a court ruling to stop tracking non-users—by requiring all visitors to sign in to view social content.
This article originally appeared on PCMag.com.