According to the regulator, the decision was taken due to Google's "lack of transparency, inadequate information and lack of valid consent regarding ads personalisation".
What's more, the regulator accused the world-famous search-engine firm of failing to ensure that consumers were adequately informed about how Google approached collecting data to personalise advertising.
CNIL said: "The information on processing operations for the ads personalisation is diluted in several documents and does not enable the user to be aware of their extent."
The regulator claims Google broke the rules by pre-ticking the option to personalise ads when creating an account.
CNIL added: "The user gives his or her consent in full, for all the processing operations purposes carried out by Google based on this consent (ads personalisation, speech recognition, etc).
"However, the GDPR provides that the consent is 'specific' only if it is given distinctly for each purpose."
In response to the ruling, Google said: "People expect high standards of transparency and control from us. We're deeply committed to meeting those expectations and the consent requirements of the GDPR."