The Hamburg data protection authority said the social network could not change people's chosen usernames or ask them to provide any official ID.
The ruling came after Facebook blocked an account set up by a woman using a pseudonym and changed it to her name.
Facebook said it was disappointed with the ruling, which German courts had previously said met European law.
"The use of authentic names on Facebook protects people's privacy and safety by ensuring people know who they're sharing and connecting with," the company said.
The company's real-name policy has been the subject of recent protests outside its headquarters in California from demonstrators, including drag queens, Native Americans and domestic violence victims who believe anonymity is crucial to their personal safety.
Some drag queens want to use their stage names on the site, while Native Americans' names often incorporate animals, natural features or other elements that can be wrongly identified as pseudonyms.
The woman in Germany had wanted to use a pseudonym to avoid unsolicited contact in relation to her business.
In October 2014, Facebook clarified its real-name policy, saying users would have to "use the authentic name they use in real life".
But organisers of June's protest say the company has been slow to change its rules.
The Hamburg watchdog, which regulates the social network in Germany, said making users sign up under their real names violated an individual's privacy rights.
It also rejected an argument from Facebook that because the company's European offices were in Ireland, it should be subject to Irish law.
In an audit in December 2011, Ireland's privacy watchdog ruled Facebook's real-name policy did not contravene the country's regulations.
But Hamburg's commissioner for data protection, Johannes Caspar, said: "For that matter, Facebook cannot again argue that only Irish data protection law would be applicable. Anyone who stands on our pitch also has to play our game."
