ALSO READFacebook buys Boston software company that authenticates govt-issued IDs Right to Privacy: Data harvesting by web firms under threat Facebook faces flak for removing birth photographer Moutrie's video Facebook discards controversial fake news warning flags Check if WhatsApp will work on your phone from Dec 31
In a case brought by Belgium's privacy watchdog, the court also ruled on Friday that Facebook had to delete all data it had gathered illegally on Belgian citizens, including people who were not Facebook users themselves.
Facebook, which will be fined 250,000 euros a day or up to 100 million euros if it does not comply with the court's judgement, said in a statement it would appeal the ruling.
"Facebook informs us insufficiently about gathering information about us, the kind of data it collects, what it does with that data and how long it stores it," the court said.
"It also does not gain our consent to collect and store all this information," it added in a statement.
The social media group uses different methods to track the online behaviour of people if they are not on the company's web site by placing cookies and invisible pixels on third party web sites, the court said.