email permission is not what blocks the user at the entrance to the system, after providing it can be deleted manually by the user, and he can avoid providing it in future interactions with your application / site.
At a minimum, the Facebook JavaScript SDK that conveys the user ID, even if the user skips providing email permission.
Juicy scripter
source share