Or just don't link personal and company accounts. Even these issues aside , there are so many reasons to keep them separate and unrelated. That's not unique to Google but goes for GitHub, AWS, and whatever else.

Use company e-mail addresses to register for everything. Enforce it for your employees. This is in the interest of both the company and the employee. Yes, the summer intern gets a corp email too, which at minimum gets access to internal resources beyond the OT chatroom revoked when they are out.

(Your advise is not bad though: grant granular access as it's needed)

It sounds like Google have other means to establish links between accounts, though? An employee using their personal account and a company account from the same browser is likely to result in a "link" or association being established between those accounts.

From what's written here, it's not clear if such links have been used for these terminations.

But yes, my point of not mixing accounts does go that far - if you don't have separate hardware, at least use separate browsers or browser profiles.

Don't put the cookies in the same jar.

Most likely yes, but as usual it's a black box, we don't really know how it works.

> just don't link personal and company accounts

Easier said than done, in my experience. Years ago I had to log into my Company's Play account on my computer for some specific reason, one time, and more than a year after that, my daughter purchased a game on my android phone and the CEO sent me a message saying "FYI, we just paid $3 for a princess coloring book app, please enjoy it with our compliments but please delete the Play Store login info from your devices." I still have zero idea how that could possibly have happened. That company will be shutting down and now I'm worried that my google account is somehow "linked" to it.

Guess: Logged in using Chrome? IIRC Chrome has specific functionality regarding retaining and linking Google account information. This is how you get the account-selector.

As mentioned in a sibling comment: Utilize browser profiles (Chromium-based/Firefox) or Multi-Account Containers (Firefox).

This may very well be the case, but it was years ago so I don't really know. This type of linking is something that always gives me the willies when it happens without warning and makes me think I should stay away from using components that are too "smart." I got really freaked out once when I was using a portable wireless access point owned by my employer (for on-call duties) in a starbucks and it told me a second device had attached to it. Turns out I had just bought a new iphone and Apple had stashed away the wifi password and automatically given it to the new phone, rather than the explanation being some hacker sitting near me in starbucks. I completely understand why they did this, but it really would have been nice to be asked if I mind if they store a copy of my password in the cloud.

> I suppose the best practice solution to this is to try to keep company Google Play accounts as "sterile" as possible?

This is probably "best" practice, but Google has randomly closed accounts for our mobile test devices. They're only used to run our (non-shady) apps on a single device that is never used with other accounts.