It is concerned that the firms' dominance in digital advertising could be harming competition.
People using these platforms also may not be control of their data, the CMA said.
The comments come amid reports that the government will create a new digital watchdog to oversee these businesses.
The Financial Times reported that the regulator will have new powers which will include enforcing a new code of conduct for big tech firms and allowing more data accessibility for consumers.
Google takes the lion's share of search advertising sales in the UK, accounting for about 90% of the market with revenue of £6bn.
Facebook takes about half of UK online display advertising revenue, reaching £2bn in 2018.
The CMA said in an interim report on the market that "big is not necessarily bad" and that both firms offer innovative products and services.
However, Facebook and Google may have become entrenched in the UK market "with negative consequences for the people and businesses who use these services every day", the competition authority said.
A lack of "real competition" could mean higher advertising costs being passed on to consumers.
It could also mean people are missing out on "the next great new idea from a potential rival", the CMA said.
The market dominance of Google and Facebook "may potentially be undermining the ability of newspapers and other publishers to produce valuable content as their share of revenues is squeezed by large platforms," the CMA added.
There is also a lack of transparency about how their platforms work, with publishers reporting dramatic drops in traffic after opaque alterations to Google and Facebook algorithms, it said.
The collection of people's personal data gives the tech giants power by allowing them to target advertising at individuals more effectively than others can, it said.
"Both for privacy and competition reasons, it is essential that people feel in control of their data. At the moment, the CMA is concerned that this is not always the case," the competition authority said.
Facebook has a "take-it-or-leave-it" approach to its service when it comes to personalised advertising, "forcing [consumers] to share considerable amounts of personal data as a condition for using the service," the CMA said. Privacy settings are difficult to access, it added.
The CMA said at this stage "there is a strong argument for the development of a new regulatory regime" which could "include rules governing the behaviour of online platforms and giving people greater control over their own data".
Should the new UK government decide not to make any new rules, the CMA said it was ready to act directly through its own powers.
Google hits back
Ronan Harris, Google UK and Ireland vice-president, said that the digital advertising industry "helps British businesses of all sizes find customers in the UK and across the world and supports the websites that people know and love with revenue and reach".
"We've built easy-to-use controls that enable people to manage their data in Google's services - such as the ability to turn off personalised advertising and to automatically delete their search history," he said.
"We'll continue to work constructively with the CMA and the government on these important areas, so that everyone can make the most of the web."
A Facebook spokesman said: "We are fully committed to engaging in the consultation process around the CMA's preliminary report, and continuing to deliver the benefits of technology and relevant advertising to the millions of people and small businesses in the UK who use our services."
"We agree with the CMA that people should have control over their data and transparency around how it is used. In fact, for every ad we show, we give people the option to find out why they are seeing that ad and an option to turn off ads from that advertiser entirely.
"We look forward to further engagement with the CMA on these topics."
Industry body TechUK said: "Personalised advertising must put consumers in the driving seat and our members are continually working to improve their services, not only to offer people more relevant adverts, but to ensure that consumers are able to control their data and how it is used.
"This is a balancing act and TechUK is committed to working with the CMA over the coming months to find the best way forward that promotes competition and continued innovation whilst protecting consumers."
No market investigation?
While the CMA may have signalled a call for tighter rules, a full-blown market investigation is not likely to be on the cards, according to law firm Linklaters.
Christian Ahlborn, global head of competition at Linklaters, said: "While the report identified a range of potential concerns as well as potential remedies, the CMA cited the risk of cutting across government regulation, as well as the global nature of the conduct under scrutiny, as key factors in its preliminary conclusion that a market investigation would not be appropriate."
Nevertheless, 2020 would probably be "a year of intense scrutiny by the CMA of the digital advertising market as it seeks to address some clear, global concerns about the sector".