It's depends on the site that uses OpenID Connect federated sign-in if they ask for your email address from the identity provider. An application/site can opti

It's depends on the site that uses OpenID Connect federated sign-in if they ask for your email address from the identity provider. An application/site can optionally request the "email" scope during OpenID Connect sign-in, but if it is not requested (only the "openid" scope instead) then the provider must not return an email address in the ID token, or an OAuth access token which is authorized for an API method which returns the user's email address (OpenID Connect Core 1.0 section 5.4 - "Requesting Claims using Scope Values"). Google implement this (https://developers.google.com/identity/protocols/oauth2/openid-connect#an-id-tokens-payload https://developers.google.com/identity/protocols/oauth2/open...), by returning only a unique numeric user ID in the returned id_token. I haven't checked other OpenID Connect providers.