It penned a missive to Google to explain what it will do with user data it collects, how long it will store it, and whether it will be linked to the person's real identity, as well as the legal justifications.
Jacob Kohnstamm, who heads the Netherlands' data protection authority, told Reuters that if Google persists in its current plan it could be in trouble.
The CNIL can give Google from a week to a few months to fix things or fine it into a coma. Other countries in the EU can deal with it differently.
Google's global privacy counsel Peter Fleischer said the search engine was committed to providing users with comprehensive privacy information. It was happy to meet European regulators to explain how it all works.
But what has the privacy watchdogs concerned is that the company will pool data it collects on individual users across its services, allowing it to "better tailor search results" and "improve service". In other words, hit each user with better personalised adverts.
Users are forbidden from opting out.