requirement would be that it must not pass email addresses to third parties without user consent\

I consider that a MUST