Europe's highest court said "general and indiscriminate retention of data" by governments is unlawful and cannot be justified within a democratic society. Only targeted retention aimed at fighting serious crimes could justify such state interference, it said.
"The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance," the court said.
A range of government departments, from police to customs officials, can access the data without a warrant.
The data being kept includes what websites each person has visited and the apps and messaging services they used, though not the specific pages they looked at or the contents of the messages they sent.
More From This Section
The government says the law will help in the fight against terrorism and crime.
"Today's judgment upholds the rights of ordinary British people not to have their personal lives spied on without good reason or an independent warrant," Liberty director Martha Spurrier said.
Britain's government said it was disappointed by the ruling and that it would put forward strong arguments to defend itself when the case returns to the Court of Appeal in London.