The universities admissions service, Ucas, broke data protection rules when it signed up teenagers to receive adverts about mobile phones, energy drinks and other products, the information commissioner has ruled.

The University and Colleges Admissions Service must now change its application form and privacy policy because of the ruling, which follows an investigation triggered by a Guardian article.

The Guardian revealed a year ago that Ucas Media, the commercial arm of the admissions service, was earning millions of pounds from companies such as Red Bull, Microsoft and Vodafone in return for channelling highly targeted advertising by text and email to subscribers as young as 16.

The Information Commissioner’s Office (ICO) found that Ucas, the gateway by which 700,000 young people a year apply to UK universities, broke electronic marketing rules because it allowed university applicants to opt out of receiving adverts only if they unchecked three boxes covering marketing emails, post and text messages. Teenagers were also encouraged to stay signed up because the opt-out wording warned that unticking the boxes would mean they would miss out on information about careers, education and health.

The ICO ruled on Wednesday that the approach meant applicants “felt obliged to let Ucas use their information for commercial purposes, otherwise they’d potentially miss out on important information about their career or education”.

The tactic breached both the Data Protection Act, which requires personal information to be processed fairly, and the Privacy and Electronic Communications Regulations, which govern electronic marketing and require consent to be given freely and for a specific purpose, the ICO said.

The ICO’s head of enforcement, Stephen Eckersley, said Ucas had a responsibility to make sure its applicants “can make free and balanced choices. By failing to give these applicants a clear option to avoid marketing, they were being unfairly faced with the default option of having their details used for commercial purposes.”

Ucas will now update its registration form and privacy policy to reflect the ruling, and will also conduct tests to make sure the updated documents are fully understood by its users. Former and current applicants can change their marketing preferences on the Ucas website or by unsubscribing via any emails received.

However, Ucas Media, with sales worth more than £13m in 2014 – a 7.5% increase on the previous year – is still heavily marketing its services to commercial companies.

Its website boasts: “At Ucas we have an exclusive undergraduate audience relying on us to process applications and provide advice, tracking and support. This gives us unrivalled student data. We have a wide range of channels to students and their advisers, and we have great insights into student interests and how to target them.”

Pointing to its success in “creating an organic social media buzz” for three new flavours of Red Bull, it tells potential clients: “Think of us as a youth marketing agency with unique reach to students and young people.”

A spokesman for Ucas said the organisation took its data protection responsibilities “extremely seriously”. He said: “We have agreed with the ICO that we will amend the wording on the Ucas application to provide greater clarity to students about the additional information they can choose to receive from us.

“This will give applicants greater flexibility about information they are sent on other education, careers and health information separately from commercial products and services.

“This does not affect the information which applicants receive from Ucas about their higher education applications. Students who opt out of additional mailings will continue to receive everything they need to manage their applications to university as well as information about other course and study opportunities, available via Ucas.”

The spokesman said Ucas did not share applicants’ personal details externally and gave revenue generated back to its charitable arm to keep down the cost of the application fee – currently £23.

The National Union of Students, which has itself used Ucas Media’s services to promote its NUS Extra discount card, welcomed the change on Wednesday. A spokesperson said: “All the big brands want to have access to students and it is extremely important that anybody responsible for student data acts in a thoughtful and responsible way and is open to the highest level of scrutiny.”