Digital legacy: what happens to your accounts when you die

A few weeks after a funeral, Facebook reminds you that it is your friend’s birthday, while her Gmail inbox keeps filling up with store coupons and the photos in her iCloud sit behind a password nobody has. That is what a digital legacy looks like in practice: the accounts, profiles, files and subscriptions a person leaves behind, whether or not anyone planned for them.

Most writing on the subject treats it as an estate question about who inherits what. This piece looks at it from the privacy side instead. We cover what an abandoned account is worth to a stranger, how scammers work through obituaries and funeral announcements, and the settings Google, Apple, Meta and Microsoft have built so you can decide in advance what happens to your data. Questions about wills and probate are out of scope here, an estate attorney is the right person for those.

What stays online when nobody plans for it

An account has no idea that its owner has died. It just keeps running until someone tells the provider or until an inactivity rule kicks in. How long that takes varies widely, and on some platforms nothing happens on its own at all.

Microsoft’s help page states plainly that you do not need to tell the company that someone has died. If you know the password you can close the account, and if you don’t, it closes itself after two years of inactivity. Facebook and Instagram work the other way round. Nothing changes until someone reports the death.

From a privacy standpoint, that means a large part of your online life stays visible or at least reachable for years. Photos you shared publicly stay public, your friend list stays visible, and the account itself remains a target for anyone who wants to take it over.

Why an abandoned account is a security risk

When Google announced in May 2023 that it would start deleting accounts unused for two years, it explained the reasoning with unusual candor. Forgotten accounts often rely on old or reused passwords that may already have leaked. Google’s internal analysis found that abandoned accounts are at least ten times less likely than active ones to have 2-step verification turned on. Once such an account is compromised, Google wrote, it can be used for anything from identity theft to sending spam.

With someone who has died, one more thing changes: nobody is left to notice a login from a strange location, and the security alerts that would normally flag it go unread. The attacker has time.

What that attacker can do depends on what the account is connected to. An email inbox is a master key, because password resets for dozens of other services land there. A social media profile has something that is almost impossible to fake: real friends who trust the name. A message from a dead friend’s account is unsettling, and for some people it feels like a sign. Certain scams count on exactly that reaction.

So the rule for a digital legacy is simple. An account nobody uses anymore should either be closed or put into a state where nobody can log in.

Obituaries as an open data source

An obituary is one of the most personal texts a family ever publishes. It names the person who died, often with birth and death dates, the town, and the surviving relatives with their relationship. Funeral homes and newspapers put these notices online, where they are indexed and searchable by name and place. For a scammer, that is a sorted list of people in the middle of a crisis.

The Consumer Financial Protection Bureau, the federal agency that oversees consumer finance, warns that some scammers check obituaries and other legal notices and then contact relatives while posing as debt collectors. The goal is either a payment for a debt that does not exist or the relative’s own personal information. The agency’s advice: never hand over a Social Security number, birth date or account number unless you know who you are dealing with. A caller who can’t or won’t explain what the supposed debt is for is a warning sign.

The same material feeds a scam that lives entirely on social media. In September 2024, security journalist Brian Krebs described a wave of Facebook groups set up for upcoming funerals. Each showed a photo of the person who had died, listed the correct date and time of the service and promised a livestream. The link led to a freshly registered site that asked for credit card details before anything would play. Some of the groups also collected donations in the dead person’s name. The reader added that a friend of his had seen the same thing when someone she knew died two weeks earlier. Everything the scammers needed came from public posts the family and the funeral home had shared.

We have covered how obituaries feed phone scams aimed at older relatives in our piece on the grandparent scam. The pattern is the same: no hacking, just reading what is already public and building a story around it.

Digital legacy settings at the big platforms

The good news is that the largest platforms now have tools that let you decide in advance what happens. They are buried in settings and work differently everywhere. What they share is that none of them hands over your password. Google, Meta and Microsoft say so explicitly, and Meta treats logging into someone else’s account as a violation of its policies, even after that person has died.

Google Inactive Account Manager. You set it up from its own page in your Google Account. You pick how long your account has to sit unused before it counts as inactive, then add up to ten people who will be emailed when that happens. For each one you can choose separately which data they may download. Google asks for each contact’s phone number, because the download only works after confirming that number. Someone who merely intercepts the email gets nothing. At the end you can tell Google to delete the account. Google counts sign-ins, Gmail use and other activity, including the Gmail app on your phone, as signs that you are still around.

Apple Legacy Contact. On an iPhone, go to Settings, tap your name, then Sign-In & Security and Legacy Contact. You need iOS 15.2 or later and two-factor authentication. Your contact doesn’t need an Apple device. What matters is the access key Apple generates during setup: without it and a death certificate, your contact cannot request access later. Apple recommends printing a copy and keeping it with your estate planning documents. If you name several contacts, each of them can act alone, including deciding to delete the account for good.

Facebook legacy contact. In Meta’s Accounts Center, under account ownership and control, there is a memorialization setting. There you either choose a legacy contact or ask for your account to be permanently deleted after you die. Deletion, according to Meta, removes all messages, photos, posts, comments and info immediately once someone reports the death. Without a legacy contact, a memorialized profile is frozen and nobody can change anything on it. Meta suggests telling your family which option you picked.

Instagram. There is little to configure in advance. Friends or family can request memorialization, and verified immediate family members can request removal with documents such as a birth or death certificate. A memorialized profile no longer shows up in places like Explore, and nobody can log in, which from a security point of view is the part that counts.

Microsoft offers no comparable feature. If someone knows the credentials, they can close the account, and Microsoft keeps the data for 60 days before deleting it for good. Without credentials, Microsoft says it will only consider releasing content after being served with a subpoena or court order, and even then makes no promises.

What you can set up for yourself today

Start with a list. It sounds dull, and it is the single most useful thing you can do. Write down your email accounts, social profiles, cloud storage, shopping accounts and subscriptions, with the username and ideally the provider’s contact details. A printed list in a safe place that you update now and then works fine.

Making that list usually reveals how many accounts you no longer need. Close them now. Deleting an app is not enough, the account at the provider survives it. Our guide on how to really delete data walks through what actually removes an account and what leaves copies behind. Every account you close today is one that can’t be forgotten or hijacked later.

Then think about the second factor. Most important accounts, from email to banking, want a code from your phone on top of the password. A trusted person with your password list still won’t get in. Write down how they could reach your phone, your authenticator app or your backup codes. If you use a password manager, its master password belongs on the list. Passkeys add a twist, because they are tied to devices and accounts, which we explain in passkeys vs. passwords.

Banks are a separate matter. A password list rarely gets anyone into online banking, and sharing the login can cause trouble of its own. Ask your bank directly how it handles authorized users and what it needs after a death.

And then there’s the question no setting answers. Some people want their Facebook profile to stay up as a place where friends can still leave a note years later. Others want everything gone. Either choice is fine. What matters is that someone knows about it before it is needed.

When someone close to you has died

In the first days after a death, nobody has energy for accounts and profiles, and that is all right. A few steps are worth taking early anyway, because they make life harder for the people who prey on grieving families.

When you write the obituary, think about what it gives away. Leave out home addresses and list the funeral home as the contact instead. Be careful with public posts that give the date, time and place of the service, since that is exactly what the fake livestream groups copy. Share those details in a private group or directly with people. If a funeral group you don’t recognize shows up, report it to Facebook and let your friends know which link is real.

For social profiles, memorialization is usually the safest option if you don’t want the account removed. It locks the profile so nobody can log in, including an attacker holding an old leaked password. Logging in yourself with a known password to save something is an understandable impulse. Meta still treats it as a policy violation, and it leaves the account just as exposed as before.

Watch the mail. Letters and calls claiming the person owed money deserve a second look, especially from companies you have never heard of or with tight deadlines. A real creditor can tell you exactly what the debt is and send proof. And before you close an email account you have access to, check which other services are tied to it. Otherwise password resets for those accounts will go nowhere.

The short version

Nobody enjoys thinking about this, and November, with its days of remembrance, is as good a time as any to do it once. From a privacy point of view a digital legacy is fairly easy to grasp. Every account that keeps running after you are gone is an unlocked door, and every public detail about your family is material for someone who wants to invent a story. Half an hour spent on Inactive Account Manager, a legacy contact and an honest list of your accounts closes most of those doors. The rest is a conversation with the person you trust to handle it.

Frequently asked questions

What is a digital legacy?

Everything a person leaves behind online: email inboxes, social media profiles, photos in cloud storage, shopping accounts, subscriptions and the devices that hold all of it. Some of it has sentimental value, some of it has money attached, and all of it can be misused if nobody looks after it.

What does Google Inactive Account Manager do?

It lets you decide what happens to your Google Account if you stop using it for a period you choose. Google then emails up to 10 people you picked, can share selected data with them as a download and can delete the account afterwards if you want. The trusted contacts need a phone number on file, because Google uses it to confirm that the right person downloads the data. Without this setting, Google may delete a personal account that has been inactive for at least two years.

What can a Facebook legacy contact do?

According to Meta, a legacy contact can write a pinned post on a memorialized profile, for example with funeral details, change the profile picture and cover photo, request that the account be removed and download a copy of what was shared if that option was enabled. They cannot log in, read private messages or remove friends. A memorialized profile without a legacy contact cannot be changed at all.

How do I set up an Apple legacy contact?

On an iPhone running iOS 15.2 or later, open Settings, tap your name, then Sign-In & Security and Legacy Contact. Two-factor authentication must be turned on. Apple generates an access key that your contact needs together with a death certificate to request access later. The contact does not need an Apple device. Apple suggests printing the key and keeping it with your estate planning documents.

Why do scammers read obituaries?

Because obituaries list names, relatives, towns and funeral dates in one place, at a moment when the family is overwhelmed. The Consumer Financial Protection Bureau warns that some scammers check obituaries and then contact relatives while posing as debt collectors. Others copy funeral details into fake Facebook groups that promise a livestream of the service and ask for card details first.