Facebook said it would appeal against the decision, which followed a case lodged by the Belgian Privacy Commission in June, accusing the US technology company of breaking EU privacy law by tracking people without their permission.
Facebook uses something called a "datr cookie" to track the online activities of anyone who visits a Facebook site or clicks a Facebook "Like" button.
The cookie is installed on the person's browser, even if they are a not member of the social network, and stays there for up to two years, allowing Facebook to consult it whenever the user pays further visits to Facebook pages or any site that features a Facebook Like button.
"The judge ruled that this is personal data, which Facebook can only use if the internet user expressly gives their consent, as Belgian privacy law dictates," the court said in a statement.
Facebook argues that the datr cookie is only associated with browsers, not individual people, and helps it to distinguish legitimate visits from those by attackers.
The company also said that, since it has its European headquarters in Ireland, it should be regulated solely by the Irish Data Protection Commissioner – which, incidently, it is doing. "We've used the 'datr' cookie for more than five years to keep Facebook secure for 1.5bn people around the world," a spokesman said in a statement emailed to the AFP news agency.
"We will appeal this decision and are working to minimise any disruption to people's access to Facebook in Belgium."