Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for creating and using virtual email addresses for user privacy protection and data security are described. In one aspect, a method includes receiving, from a user device and at an identity server, login credentials for a first email address mapped to a first set of user information values, detecting, by the identity server, a trigger event, in response to detecting the trigger event, creating, by the identity server, a new virtual email address separate from the first email address and mapped to a second set of user information values different from the first set of user information values, detecting, by the identity server, a request for credentials from a requesting entity, and in response to detecting the request, transmitting, by the identity server, the new virtual email address as new login credentials to the requesting entity.