According to ICO, teenagers applying for further education were wrongly signed up to receive adverts about mobile phones, energy drinks and other commercial products and services.
This means that UCAS was breaking electronic marketing rules and this is why it is now required to changes its practices.
The Office decided to investigation the admissions organisation following a newspaper article in March 2014 which raised concerns about the application form.
In order for applicants to opt-out of receiving marketing communications, they were required to un-tick three boxes covering marketing emails, post and test messages.
Besides this, the boxes were worded in a manner which meant that even if the user did un-tick these boxes, they would miss out on information regarding career opportunities, education providers or health information.
The ICO claims that such an approach led applicants to feeling obliged to let UCAS use their information for commercial purposes because they feared missing out on important information about their career or education.
This method breaches the Data Protection Act because it requires personal information to be processed fairly.
The organisation has also breached the Privacy and Electronic Communications Regulations that govern electronic marketing and require consent to be given freely and for a specific purpose.
“Each year more than half a million teenagers register with UCAS to apply for a place in higher education,” claimed ICO head of enforcement Stephen Eckersley.
“UCAS has a responsibility to ensure that applicants can make free and balanced choices. By failing to give these applicants a clear option to avid marketing, they were being unfairly faced with the default option of having their details used for commercial purposes.
“Our guidance is clear that consent must be freely given and specific,” Eckersley added.
Those who have already used the service are able to update their preferences on the website or using the unsubscribe options in the emails they receive.