Under German law, providers of online services must allow users to remain anonymous and that personal information can only be recorded or used by a company with explicit agreement from the individual.
The lawsuit also accused the US online social media and networking service of leaving many settings switched on by default and failing to offer users a meaningful choice about how their data was used.
"Facebook hides default settings that are not privacy-friendly in its privacy center and does not provide sufficient information about it when users register," said Heiko Duenkel, litigation policy officer at the VZVB. "This does not meet the requirement for informed consent."
Facebook, which counts more than 2 billion users worldwide, already faces scrutiny from Germany's competition authorities over handling of its users' personal data.
Facebook said it would appeal the Monday court ruling, adding that many of its terms of service had changed since the suit was first brought in 2015.
"We are working hard to ensure that our guidelines are clear and easy to understand, and that the services offered by Facebook are in full accordance with the law," Facebook said.
Germany is a major market for Facebook in Europe, with around 30 million of the country's 80-million strong population signed up and almost 23 million using the network every day.
More about: Facebook