An application/site can optionally request the "email" scope during OpenID Connect sign-in, but if it is not requested (only the "openid" scope instead) then the provider must not return an email address in the ID token, or an OAuth access token which is authorized for an API method which returns the user's email address (OpenID Connect Core 1.0 section 5.4 - "Requesting Claims using Scope Values").
Google implement this (https://developers.google.com/identity/protocols/oauth2/open...), by returning only a unique numeric user ID in the returned id_token. I haven't checked other OpenID Connect providers.