In a case brought by Belgium's privacy watchdog, the court also ruled on Friday that Facebook had to delete all data it had gathered illegally on Belgian citizens, including people who were not Facebook users themselves.
Facebook, which will be fined 250,000 euros a day or up to 100 million euros if it does not comply with the court's judgement, said in a statement it would appeal the ruling.
EU tells Facebook, Google and Twitter to 'do more' for users
"Facebook informs us insufficiently about gathering information about us, the kind of data it collects, what it does with that data and how long it stores it," the court said.
"It also does not gain our consent to collect and store all this information," it added in a statement.
The social media group uses different methods to track the online behaviour of people if they are not on the company's web site by placing cookies and invisible pixels on third party websites, the court said.
COMMENTS
Comments are moderated and generally will be posted if they are on-topic and not abusive.
For more information, please see our Comments FAQ