Windows 10 gathers an "excessive" amount of personal data on users, the French data authority has said in a formal notice.
Following complaints the operating system breached France's Data Protection Act, the National Data Protection Commission (CNIL) found "many failures".
The CNIL has now given Microsoft three months to comply with the act.
A Microsoft executive said the company would "work closely" with the CNIL.
By default, Windows 10 collects various data on how it is used - this includes what apps are installed and how much time is spent within them, for example.
"[Microsoft] is collecting excessive data, as these data are not necessary for the operation of the service," said the CNIL.
The authority also criticised the fact that an advertising ID is activated by default, which allows apps to monitor user browsing and then offer targeted ads.
In the CNIL's view, this has been done "without consent".
Read more on BBC.