Sure, and maybe they'll put it right next to the "you're not allowed to save any data" clause.

One is much easier to inspect and verify than the other.

There's really no way to check if someone has made a copy of data if you've given them that data.

It's not that hard to check if an application prompts a user for an email address.

One is fairly trivial to prove compared to the other.

But there are many legitimate use cases of sharing email addresses. Just scratching the surface,

* someone used Facebook Connect to login to NYTimes Web site, curious about their Food & Recipes newsletter, wants to sign up

* someone logging into e-commerce shop through Facebook Connect, making a purchase and then deciding that yes, they would like to track and manage their order on the retailer's Web site, and they will even sign up for an account with retailer to do that

Neither one of those use cases would necessitate using the user's real email address instead of the forwarding address that Facebook provided.

Which is fine. But most apps that I remember of this type (back when I used Facebook apps) would ask you for it on landing. Nothing ever has to be black-and-white.

Which they flagrantly violated...