What happens to your online accounts when you die

You do not own your online accounts. You hold a licence to use them, granted by a contract that ends when you do. That is why an estate can inherit the value inside an account and still have no legal right to log into it.

Two separate locks stand between your family and your digital life. The first is legal authority: whether the law says your executor may deal with the account. The second is practical access: whether anyone can actually get in. Most countries have made progress on the first lock. Nobody has solved the second. The tools that come closest are the ones the platforms built themselves, and they only work if you switch them on while you are alive.

Why "just leave them the password" does not work

It is the obvious answer and it is the wrong one, for three reasons.

[Image 1 here]

It usually breaches the contract. Nearly every consumer terms-of-service agreement prohibits sharing credentials and prohibits third parties using the account. A provider that discovers a dead person's account being used can suspend it, which is the opposite of what the family wanted.

It may be a criminal offence. In the UK, the Computer Misuse Act 1990 makes unauthorised access to a computer system an offence, and authority does not automatically pass to a grieving relative who happens to know the password. Australian law criminalises unauthorised access to restricted data in similar terms, which is precisely why the New South Wales Law Reform Commission flagged executors as being at legal risk. In the United States, the Stored Communications Act bars providers from disclosing communications without lawful consent.

Passwords go stale. A password written down in 2021 fails against a 2026 two-factor prompt sent to a phone number that has since been cancelled. In practice, the phone and the phone number are more important than the password, and both are usually the first things a family gives up.

There is one more trap. In England and Wales, a will that has been proved becomes a public document, and probated wills are public records in most US states too. Passwords do not belong in a will. They belong in a separate, updatable inventory that the will points to.

What the platforms actually let you do

This is where the real answers live, because a platform tool is the only mechanism that works without a court.

Apple

Apple's Legacy Contact is the strongest of the consumer tools. You nominate someone, Apple generates an access key, and after your death that person submits the key plus a death certificate to get a dedicated account holding your data. Apple's own guidance on adding a Legacy Contact is worth following exactly, because the access key is the whole system: Apple does not keep a retrievable copy, so a lost key puts your family back at square one.

What comes across is stored data: photos, messages, notes, files and device backups. What does not: purchased films, music and books, subscriptions, and everything in iCloud Keychain, meaning no saved passwords, passkeys or payment details. Your Legacy Contact can read your entire inbox and still cannot sign into your bank.

Without a Legacy Contact, families use Apple's process for a deceased family member's account, which typically needs a death certificate and often a court order. Note also that Apple cannot bypass a device passcode. The iPhone in the drawer stays locked whatever paperwork you have.

Google

Google's tool is Inactive Account Manager, and it works on inactivity rather than death. You choose a waiting period of three, six, twelve or eighteen months. Google warns you first at your recovery email and phone. If nothing happens, it notifies up to ten people you named, gives whichever of them you chose a download link for the specific products you ticked, and optionally deletes the account.

Two limits matter. It is slow by design, so the minimum wait is three months plus the warning stage, which is no use to anyone trying to settle an estate this month. And it only sees Google. Separately, Google's inactive account policy allows personal accounts to be deleted after two years of inactivity, which means doing nothing is itself a decision.

Meta

Facebook offers a genuine choice made in advance: memorialise the account, or delete it when your death is reported. A legacy contact can manage a memorialised profile, but cannot log in and cannot read your private messages. Memorialisation is one-way, so the account never returns to normal.

Instagram is a separate process under the same Meta memorialisation policy, with memorialisation or removal available on request and no legacy-contact equivalent. Families routinely assume setting one covers the other. It does not.

Microsoft

Microsoft is the outlier, and the harshest. Its published position on accessing accounts when someone has died is that it must first be formally served with a valid subpoena or court order before it will even consider whether it can lawfully release a deceased person's email or OneDrive content, and it will not act on emailed or faxed requests. Even then, release is not guaranteed.

The exception is revealing. Microsoft's same guidance tells customers in Germany to contact support with a certificate of inheritance, because German law gives heirs a claim the company has to honour. Your rights here depend less on Microsoft's policy than on where you live.

X

X has no memorialisation and no legacy contact. Family or an estate representative can request deactivation with a death certificate and ID, and that is the only outcome available. X does not hand over login credentials, direct messages or archives to anyone.

[Image 2 here]

The law: four different answers

United States

The Revised Uniform Fiduciary Access to Digital Assets Act, adopted by nearly every state, sets a three-tier priority. An online tool you used, such as a legacy contact or Inactive Account Manager, controls first. If you used none, your will, trust or power of attorney controls. Only if you left neither do the platform's terms of service apply.

The consequence catches people out: the tool you clicked outranks the will you signed afterwards. If you named a legacy contact in 2022 and wrote a will in 2026 leaving your digital assets to someone else, the 2022 click may well win. RUFADAA also distinguishes content from catalogue, so without explicit consent a fiduciary may get a log of who you emailed rather than what you wrote.

United Kingdom

There is no UK equivalent of RUFADAA. The Property (Digital Assets etc) Act 2025 reached the statute book in December 2025 and confirmed that digital things can be personal property under the law of England and Wales, which matters a great deal for crypto and much less for a Gmail account. As the Law Society's analysis sets out, property status is not the same as access, and executors still need the provider's cooperation to get into an account.

One useful point for executors: the Information Commissioner's Office confirms UK GDPR does not apply to deceased people, so a provider citing data protection as a blanket reason to refuse is on shakier ground than it sounds.

The EU

GDPR recital 27 says the regulation does not apply to the personal data of the dead, and leaves member states free to legislate. Two have gone in opposite directions.

Germany did it through inheritance law. In July 2018 the Federal Court of Justice held that a Facebook user contract passes to the heirs by universal succession under the Civil Code, giving them access to the account and its contents. The Library of Congress summary of the ruling is a clear account of the reasoning: the court treated the account, not the person, as what the other party was communicating with.

France did it through data protection law. Article 85 of the loi Informatique et Libertés, added by the 2016 loi pour une République numérique, lets anyone leave binding directives about the retention, erasure and communication of their personal data after death, and obliges online services to tell users what happens to their data when they die. The CNIL's guidance on "mort numérique" explains what heirs can do when no directives were left. Worth knowing: the certified trusted-third-party register the law envisaged was never brought into force, because the implementing decrees were never published, so in practice directives go to the provider or to a notary.

Australia

Australia has no statutory scheme. The NSW Law Reform Commission's report on access to digital records upon death or incapacity recommended one in December 2019, and Attorneys-General agreed in late 2021 to prioritise the work with NSW leading. Until something is enacted, Australian executors are in the uncomfortable position of holding legal authority over an estate while the access itself may be a criminal offence.

Canada sits in a similar gap. The Uniform Law Conference of Canada produced a model act in 2016, but adoption is a provincial decision rather than a national one.

What actually gets lost

The photos, usually. Twenty years of a family's images now sit in one cloud account behind one password, where a shoebox used to sit on a shelf that anyone could reach.

After that, in rough order of pain: the email account, which is the master key to password resets on everything else; subscriptions that keep billing a closed card and generate collections letters; loyalty points and air miles, most of which are non-transferable by contract; domain names and monetised accounts with real commercial value; and cryptocurrency in a self-custody wallet, which is unrecoverable without the private key no matter what any will or court says.

A short setup that covers most of it

Not a full estate plan, just the parts that fail most often.

1. Set the platform tools today. Apple Legacy Contact, Google Inactive Account Manager, and a Facebook legacy contact or delete-on-death choice. These are the only mechanisms that work without a court, and they take minutes.

2. Write a separate digital inventory. Accounts, what each is for, and what you want done with it. Not the passwords in the same place, and not inside the will itself.

3. Use a password manager with an emergency access feature, and nominate someone. This is the closest thing to a working answer for the credentials problem.

4. Name the second factor. Say who should keep the phone number alive and for how long. This single line saves more trouble than anything else on the list.

5. Add a clause to your will authorising your executor to deal with your digital assets, and check whether it conflicts with a platform tool you set years ago. In the US, the tool wins.

6. Review it when anything changes. A tool set once and forgotten is how people end up with an access key nobody can find.

If you are updating your will anyway, this is the same planning session where questions like the difference between term and whole life insurance get settled, and it is more efficient to deal with the digital estate at the same time as the rest.

FAQ

Can I just put my passwords in my will?
No. A proved will becomes a public document in England and Wales and probated wills are public records in most US states, so anything written in it stops being secret. Keep a separate inventory and have the will refer to it.

Does a legacy contact get to read my private messages?
It depends on the platform. A Facebook legacy contact cannot. An Apple Legacy Contact can, because messages are part of the account data that transfers. Read what each tool actually grants before assuming.

What happens if I do nothing at all?
Most accounts go quiet, then lapse. Google may delete a personal account after two years of inactivity and Microsoft closes inactive accounts on a similar timescale. Social profiles often linger indefinitely until someone reports the death.

Do my purchased films, music and books pass to my family?
Generally no. Those are licences to you personally and they end with you, which is why Apple explicitly excludes purchased media from what a Legacy Contact receives.

Is it illegal for my spouse to log into my account after I die?
Potentially, yes. In the UK the Computer Misuse Act 1990 covers unauthorised access, and Australian law is similar. Prosecutions of grieving relatives are not a realistic worry, but the point matters when a provider or another beneficiary challenges what was done.

This article is general information about how digital accounts and estates are treated in different jurisdictions. It is not legal advice, the law in this area is changing quickly, and platform policies change without notice. Speak to a qualified solicitor, attorney or estate lawyer in your jurisdiction before acting on any of it.