France's data protection commission has ordered Microsoft to "stop collecting excessive user data" and to stop tracking the web browsing of Windows 10 users without their consent. In a notice published on Wednesday, the CNIL said that Microsoft must also take steps to guarantee "the security and confidentiality" of its users' personal information, after determining that the company was still transferring data to the US under the "Safe Harbor" agreement that an EU court invalidated in October. Microsoft has three months to comply with the orders, the CNIL said.