Comment by B1FIDO
15 hours ago
Step zero. Never disclose your email address to anyone.
This is very easy and straightforward. I operate 6 Gmail accounts, and three are "alts" where I've basically never given the address out to anyone at all, and they receive zero spam, zero UCE, zero marketing emails.
Of course, on my "main" I've disclosed the address to many entities and I use it for sign-in and shipping and many things. And yes, I do receive spam and scam emails there, but wcyd?
I recently had a "role" Google account terminated because I was (paraphrasing) "violating Google policies" by having multiple accounts. I didn't know they were sticklers about that.
(I don't much care because the account was just used for interacting with somebody else's Google-hosted junk but, if I had been using it for something serious, I have probably been frustrated.)
There is no way, no possible way that Google prohibits the use of multiple accounts. They do not. They cannot. I just asked Gemini and I checked the actual TOS. It does not, in any way, prohibit these uses.
In fact, this is plainly evident by the way they give you tools to operate them in a systematic way. You can add multiple accounts to a single Android "user". You can add them to a single Google Chromebook account under one signed-in account. You can add multiple accounts separately to the same Chromebook.
You can add multiple accounts with the same names, the same birthdates, and the same Driver License. I've validated at least two YouTube channels by showing exactly the same ID.
Google did not terminate your account for the reason you state. You are not telling us all the background information.
Google may indeed terminate multiple accounts for the same person because of TOS violations. They will definitely link and associate your accounts, so making an "alt account" for misbehavior is not safe. If my "alt account" is compromised or violates TOS, then I can expect they will discipline all 6 equally, because they're all linked.
But operating multiple accounts is very explicitly supported by Google, and by Microsoft as well, I will say. I don't know about Apple. Facebook definitely prohibited this in the past, although you can maintain multiple "profiles" and "pages" that have unique settings and personalities.
Apparently my account "violated TOS" (though I don't see how). The other account was used to interact with a Google Workspace in 2016, and hasn't been used since. I don't particularly care to waste mental energy trying to figure out the methodology behind Google's decision here.
This happening seemed kinda sketchy to me (because I've heard of people having several Google accounts) but, like I said, I didn't really care too much.
Anyway, here's how it went down:
In 2016 I was working w/ a Customer who was using some Google product (I believe Workspace) and I have to have a Google account to interact w/ it. Because I didn't care for them to see my "personal" Google account I make this one-off account.
This account is a Google account w/o Gmail (i.e. the username is not "@gmail.com"). That may be a factor.
Over the years I'd receive notifications that Google was going to delete the account for inactivity. I'd logon again to keep it active.
On 2026-01-12 I got a notification that my old "role" Google account was going to be deleted for being inactive for two years. I decided I wanted to keep it so I attempted to logon. The password in my vault didn't work. I found that perplexing, so I did a "Forgot password" workflow. As part of that I was offered an SMS option. I used the telephone number I use for my main Google account. For sure they "know" I'm the same operator of both accounts.
I don't believe somebody guessed the password on this account and was using it because (a) I was notified it was inactive, and (b) the password was a random 16 character alphanumeric string used only for this account. Something was clearly sketchy about the password being "wrong", though.
I completed the "Forgot password" workflow on the "role" account and got access. I decided to enable TOTP and my "real" Gmail account as the recovery contact. Everything seemed fine.
On 2026-01-13 I received a message as-follows:
> From: Google <no-reply@accounts.google.com>
> To: MyUsername@NotGmail.example.com
> Subject: Your Google Account has been disabled
> It looks like this account was created or used with multiple other accounts to violate Google's policies. The account might have been created by a computer program or bot.
> If you think your account was disabled by mistake, submit an appeal as soon as possible.
> Disabled accounts are eventually deleted. You’ll need to submit an appeal soon to keep your emails, contacts, photos, and other data saved in your Google Account.
> If you live in the European Union (EU) or are an EU citizen, there may be additional resolution options available to you.
I did a “reset” a few years ago where I moved to a fresh gmail address, forwarded my old one, and updated all my accounts to use Apple’s Hide My Email service, unique per sender.
After a few years of updating addresses that I’d missed whenever something showed up that was forwarded from my old gmail account, I shut down my old account.
No more spam, whenever I start receiving spam to a Hide My Email address, I deactivate it.
I feel like an easier solution to having six different email addresses is to use Gmail aliases - I've caught a few less-than-honest companies either selling my email address, or been breached without disclosing such, simply by using an alias along the lines of '+service_name'. If any alias starts to receive spam you can setup rules to automatically delete everything that comes in with that. You also get the added benefit of significantly easier and more accurate search.
I don't think y'all understand why I have separate Google accounts.
I use them for different purposes. They are "role accounts" for projects I am doing, such as geneaology and astronomy.
In order to use YouTube sanely, and store different stuff in Drive, I separate them into unique accounts. I use those accounts for specific things, and my YouTube subscriptions, playlists, etc. are tailored for each role, for example.
This is not about email at all. Obviously, I can access all those email accounts through the one app on my smartphone or the one PWA on my Chromebook. They are easily manageable but separate.
I also run 3 Outlook/Microsoft accounts, and for the same reason. (One of them is my academic account from community college, and the other two are personal.)
I don't need to give out email addresses for the "role accounts" except where I "Sign In With Google" to various services. So I don't really send/receive email from them at all, except where I'm sharing links or documents with myself (the best way to do this cross-account is still by using email, oftentimes.)
I receive at least a dozen spam emails every day, sometimes as many as 60.
Rarely does more than one per day show up in my main inbox.
Why should I care who has my email address?
Well, spam is no big deal, and any scam that comes via email should not affect anyone who is educated and prepared for them.
Of course, with a well-known email address, you could run a higher risk of credential stuffing, and an account takeover by someone who hijacks your email account, and then pivots from there to taking other accounts.
But this seems to be a risk we all take: email addresses are meant to be shared, to be public, and to be well-known to anyone to correspond with us.
I will say that disclosing my email address to certain parties has had noticeable effects. For example, I used "MYADDRESS+Echovita@gmail.com" once, and only once. My godfather had passed away, and I ordered some flowers for his funeral. And I put that order through with that email address.
Well, Echovita themselves had a data breach shortly afterwards, and I was inundated with scam emails. Just all sorts of attackers and they were basically all using the same M.O. But they were readily identifiable because I had used that "+Echovita" to identify it uniquely. And they really haven't stopped coming in. It's been 5 years since that breach.
So yes, especially with untrusted parties, it may help to tag your email address. I don't worry about receiving spam anywhere. But like I said, since I've never ever disclosed the addresses of 2-3 of my "alt accounts" they simply never receive any mail at all, spam or no spam.
Spammers, if minorly sophisticated, can strip those identifiers,
so wildcard mail acceptance on servicename@customdomain.com takes the crown if you’re setting this up fresh!
1 reply →
I might be missing something, but if you’ve never given them out to anyone at all, then what’s the point?