It's got three months to stop tracking French non-users without their consent and was told to quit transferring some data under Safe Harbor.