Your user signs in with Google today and Apple tomorrow. Is that one account or two?

I was thinking about this because it sounds like such a small product decision, but I don’t think it actually is.

Someone signs up with Google. Six months later they are on their iPhone and tap “Sign in with Apple.” Same person, different identity provider. And if they use Hide My Email, you may not even get the same email address.

So what should the product do?

Creating a new account feels wrong because now their history, billing, settings, or subscription can end up split across two profiles. But automatically linking accounts based on email also feels risky, because now you are assuming that matching email addresses are enough proof that both identities belong to the same person. And then Apple makes it even messier because the emails may not match at all.

I’m curious how people here think about this.

Do you treat each identity provider as a separate account unless the user explicitly links them? Do you auto-link in some cases? Do you have some other rule entirely?

And if you have dealt with this in a real product, what edge case caused the most trouble?