The court found that a number of Facebook's default settings, such as a location service setting that revealed a user's location to chat partners in the Facebook mobile app, did not comply with German privacy laws as the social network did not ensure that users were informed about these pre-determined settings.
The District Court of Berlin also invalidated eight clauses in Facebook's conditions of use, ruling that these pre-formulated consent forms did not grant Facebook any effective consent for the use of consumers' personal data.
Facebook says it's appealing the judgement, and that it has already updated numerous settings in its privacy center.
The court agreed with vzbv that Facebook users were not sufficiently informed about privacy-related options before registering for the service, which made it impossible for them to evaluate and really consent to the privacy policies and terms of service.
The Federation of German Consumer Organizations (abbreviated from German as VZBV) filed the lawsuit against Facebook and published the judgement on its website last week.
"Our products and policies have changed a lot since this case was brought, and further changes to our terms and data policy are anticipated later this year in light of upcoming changes to the law", said a Facebook spokesperson, speaking to the BBC. Facebook has said that it will appeal the decision. The Federal Data Protection Act [text, PDF] permits personal information to be recorded and used by a company only with explicit agreement from the individual.
In addition, in the privacy settings, boxes that allow search engines to link to the user's timeline were already checked, meaning that a user's profile could quickly and easily be accessed by anyone.
Facebook collects information from both WhatsApp and Instagram - both companies owned by Facebook - when a new user registers.
Facebook's chief operating officer, Sheryl Sandberg, said at the time the changes would "make it much easier for people to manage their data".