The two platforms have three months to adapt their practices, after which France will impose fines of 100,000 euros per day, CNIL added.
Google told AFP it would change its practices following the ruling.
"In accordance with the expectations of internet users... we are committed to implementing new changes, as well as to working actively with CNIL in response to its decision," the US firm said in a statement.
Cookies are little packets of data that are set up on a user's computer when they visit a website, allowing web browsers to save information about their session.
They are highly valuable for Google and Facebook as ways to personalise advertising -- their primary source of revenue.
But privacy advocates have long pushed back.
Since the European Union passed a 2018 law on personal data, internet companies face stricter rules that oblige them to seek the direct consent of users before installing cookies on their computers.
90 notices issued
CNIL argued that Google, Facebook and YouTube make it very easy to consent to cookies via a single button, whereas rejecting the request requires several clicks.
It had given internet companies until April 2021 to adapt to the tighter privacy rules, warning that they would start facing sanctions after that date.
French newspaper Le Figaro was the first to be sanctioned, receiving a fine of 50,000 euros in July for allowing cookies to be installed by advertising partners without the direct approval of users, or even after they had rejected them.
CNIL said recently that it had sent 90 formal notices to websites since April.
The fines were based on an earlier EU law, the General Data Protection Regulation, with CNIL arguing that the companies had failed to give "sufficiently clear" information to users about cookies.