Well here this is the CNIL threatening to fine Facebook. The CNIL does not have much power though, and the worst that may happens for Facebook will be to be fine a few thousands euros.
Since 2004 they can fine up to 3 000 000 € [0]. Still not much for Facebook but better than a few thousands. More importantly, assuming the CNIL has a case, I assume Facebook has an obligation to comply (I guess they can't just pay the fine and keep doing whatever they were doing).
New EU privacy law has some rather more potent fines though: for intentionally violating some of the articles in the new regulations, the fine is 20m€ or 4% of revenue, whichever is the higher number.
