Digital legacy – what happens to your online data after you die
What happens to your social media, streaming and e-banking accounts when you die? Here’s what your loved ones need to do to get access to your data after you pass away – and what you can do to make it easier for them.
When a person dies, it’s first and foremost an emotional loss for their close friends and family. However, it’s also a huge bureaucratic burden. Managing the estate of a deceased person means making phone calls to countless companies, authorities and other bodies. In recent years, an additional layer has been added – your virtual presence. The internet is now part of virtually every aspect of life.
You produce tons of data every day. Let’s take social media profiles – posts on X (formerly Twitter), pictures on Instagram, videos on TikTok and so on. On top of this, a wide range of services have also moved online. You might do your shopping online, store your data in the cloud, have digital subscriptions, manage your pictures on Google, own digital assets and do your banking with fintech companies such as PayPal or Revolut.
What happens to all of this when you die? What do your loved ones have to do to get access to this data or to make sure it’s deleted? And what can you do in your lifetime to make it easier for them? Please note that any legal information in this article is based on Swiss law and may not apply to other countries.
Preparing your digital life
I tried to get an overview of my accounts and was surprised how many there are. I can only imagine how difficult it would be for others to even find out which online services I use – what’s more, some with a pseudonym.
To spare your loved ones this research, there are a number of precautions you can take. And they’re worth taking, regardless of your age and health. If anything happens to you, your loved ones will need numerous official documents to access your digital data. Without proof of death and certificates of inheritance, they won’t get access. This costs an enormous amount of time and nerves. Some online platforms allow you to avoid this.
Managing accesses
The most effective help is also the simplest: make a list of the platforms you use and your login details. This involves a certain risk, but saves your loved ones a lot of work.
Sure, you could make a list and print it out. But that doesn’t make much sense. Apart from the fact that it gets lost easily, you’d need to update it regularly. Instead, you’re better off preparing a document and saving it digitally – preferably on an external SSD or memory stick. Tell a trusted person where they can find this list if they need it.
Another solution is using a password manager. This is a program that allows you to create an encrypted document containing all your access data, protected by a master password. Of course, as in the previous solution, you’ll need to tell a trusted person about this.
If you don’t want to make a complete list, the Swiss Federal Data Protection Commissioner (FDPIC) suggests you at least write down the access data to your e-mail account. Most online services require an e-mail address to reset the password. This makes it easier for your loved ones to wrap their heads around your online activities in the event of your death.
If you don’t want that, there are dedicated solutions such as Legacy Notes (page available in German only), which allow you to define which people have access to your passwords – and when. For example, you can specify that a person is authorised to access these details, but only after your death. In this case, your details will automatically be forwarded to the contact you chose. With this solution, you don’t have to write down passwords or give them to anyone during your lifetime.
SecureSafe also offers this function and works with an activation code that can be used to view passwords after a certain period of time. Both are Swiss services that offer a free basic package.
Keeping order
Thank you, Captain Obvious. If you no longer need a service, cancel it or close the user account. Even if it’s a free account. This is helpful in more ways than one.
On the one hand, it saves others work should they ever have to settle your estate. On top of this, there’s always a risk of access or personal data being leaked to the internet in the event of a data breach. The danger is particularly great with services that you no longer use, as you won’t update your password there.
Using the possibilities online services offer
Some well-known online services offer features to take precautions. Here’s a list of the largest and most famous ones.
Meta
Facebook and Instagram offer such options. Under «Accounts Centre», in the menu item «Personal details», you can regulate what should happen to your account if you die. Click on the option «Account ownership and control», then on «Memorialisation».
Source: Florian Bodoky
Here you can decide whether you want your profile to be deleted or memorialised after you pass away. If you choose the memorialisation option, your legacy contact can update profile and cover photo, the rest remains the same. The profile is marked accordingly.
You can then choose who will be responsible for this profile in the event of your death. On Instagram, you can only choose to have your profile deactivated or deleted, but you can also designate a legacy contact.
Source: Florian Bodoky
However, if you go for the memorialisation option, it’s difficult for others to enforce a complete deletion with Facebook. This can be problematic if they’d rather not have your profile floating around the web after your death. They could then assert the «right to be forgotten» (DSG Art. 32 Par. 2), but it’s difficult to enforce this.
With WhatsApp, the account is deleted after 120 days of inactivity. But inactivity also means that there are no incoming messages. Since WhatsApp is currently linked to a mobile phone number, this takes care of itself with the cancellation of the mobile contract.
Google offers a so-called Inactive Account Manager that allows you to set a period of time – between three and 18 months – after which your Google account (with e-mails, drive, photos, etc.) will be marked as inactive.
Source: Florian Bodoky
Once this option is activated, you can specify up to ten people to be notified if your account is marked as inactive. All you need to do is provide their e-mail address and mobile phone number to verify their identity.
You can also select which data to share with these people. Last but not least, you can choose to delete the Google account after another three-month period.
Apple
Apple also allows you to store a legacy contact in your iCloud under «Password & Security» in the «System Preferences» menu. If you click on «Legacy Contact», you’ll get a notification on all devices that run under the same Apple ID. You can then choose a contact and send an access key to them.
Source: Florian Bodoky
But keep in mind Apple will only hand out your data after being presented with this key and a notarised death certificate. As with Google, it’s also handy to designate a legacy contact with Apple.
Source: Florian Bodoky
Your legacy contact gets access to all Apple devices that run under this Apple ID. In other words, your relatives don’t have to get access to each device separately.
Microsoft
Unfortunately, Microsoft doesn’t offer a legacy contact feature. See below.
Arranging your online legacy
In your will, you can define who inherits what. This also applies to digital possessions, such as games on Steam or movies you’ve purchased on YouTube as well as the data you produce on the internet. But especially when it comes to data, you might not want anyone to see it all. Or only select loved ones. There are legal regulations for this in Switzerland. The Swiss Civil Code Art. 517 states that you can appoint one or more persons as executors of your will. As a rule, this is a notary.
You can give the executor precise instructions on what to do with the data in your online services – each service separately. You can define if anyone should get access to the credentials for certain services and if so, who. You can have the executor delete data without any of your relatives ever getting access to it.
However, it’s important to specifically mention these instructions. Why? The actions of an executor are fundamentally limited to property law. These instructions, however, affect aspects of personal rights and data protection. This is a so-called «fulfilment of conditions», as regulated in Art. 482 of the Swiss Civil Code.
What’s important to know is that, in theory, you can entrust anyone with the execution of your will – or parts of it. You could choose a close friend to do so. However, you’re probably better off deciding on a neutral person who has the required legal expertise.
There are also online providers in Switzerland that will take care of your entire legacy planning. For example, tooyoo.ch. The legacy dossier needs to be legally valid and stored in Switzerland.
Managing someone else’s digital legacy
First, let’s define two important terms. «Digital legacy» is understood to be all digital information of a deceased person. This includes their digital assets, such as cryptocurrency and NFTs, but also games or movies they purchased on Steam or YouTube.
«Digital legacy management» refers to the procedures and legal guidelines in the administration of the digital legacy. In other words, what needs to be done when to ensure that the digital legacy is handled correctly. Digital legacy management isn’t an official legal term, but it’s often used.
There are no specific legal regulations for digital legacy management. The same laws apply to data or virtual assets as to analogue ones such as a painting or a tea set. This is referred to as «universal succession», which is regulated in Art. 560 of the Swiss Civil Code.
This sounds simple and clear in theory. And some of it is. If, for example, you inherit a memory stick, you also inherit the data that’s on it. However, it’s a different story when it comes to data that’s on the internet. Although you can inherit this data, you’ll need to overcome various obstacles if you want to enforce your right to it.
On the one hand, there’s the issue of missing access data and, on the other hand, the contracts that the decedent entered into when accepting the GTC of a service. In many cases, like with Facebook or Apple, you’d be violating these terms and conditions by logging into these accounts as a third party.
In addition, GTC are often based on the law of another country, which also has its place of jurisdiction abroad. These laws sometimes contradict each other, so it’s worthwhile to consult a notary. It’s especially difficult with cryptocurrency. Why? First of all, the legal situation is still unclear. Moreover, no one can access the stored assets of a cryptowallet without knowing the credentials. Even if a trading platform wanted to help you, they couldn’t.
No precautions taken – now what?
If a loved one passes away and has entrusted you with managing their digital legacy, but no list with access data is available, things get a bit complicated. But most providers will offer you assistance.
First, you need to get an overview of what online services the person used. You can do this by checking their computer or an external storage medium. If you have access to their computer, you’re halfway there, as most browsers offer password managers, which list all services. If you were able to log into their device, the same password will allow you to view the contents of such password managers.
How to the access password manager in the browser
Chrome
Chrome’s password manager is prominently placed.
Source: Florian Bodoky
Click on the three vertical dots, then select «Google Password Manager».
Firefox
Open Firefox, click on the three horizontal bars in the upper right corner.
Source: Florian Bodoky
Go to the menu «Passwords».
Edge
For Edge, go to the settings, then click on «Profiles».
Source: Florian Bodoky
Then go to «Passwords».
Safari
In Safari, go to Safari at the top, then select «Settings».
Source: Florian Bodoky
Select «Passwords».
E-banking
As a rule, banks block an account of a deceased person if no other arrangements are made. This also applies to online access. In order for anyone to gain access to it, they will usually need to present a certificate of inheritance and all other persons entitled to the inheritance must agree to this. Virtually all banks offer an FAQ page with specific information on this. Dealing with the bank usually takes some time, but isn’t a problem.
To get access to credit card statements – also to be able to settle any outstanding debts – you can assert your right to information. This is regulated in Art. 607(3) and Art. 610(1) and (2) of the Swiss Civil Code. However, this also requires a certificate of inheritance.
Things get more complicated if the deceased person used financial service providers that aren’t backed by a bank, but by fintech companies.
PayPal and Revolut are particularly well known and popular examples. Both providers are based abroad, but offer a help page with information on how to proceed in the event of the death of a loved one.
Social media
If you don’t have the deceased person’s social media account credentials, you’ll need to contact customer service. Most services offer a form you can fill in and request to delete an account.
Facebook lets you choose to have an account deleted or memorialised. If you choose the latter, the account remains online, but no more changes can be made.
Source: Florian Bodoky
A request for deletion will only be approved if a death certificate is available. The same goes for Instagram.
Instagram offers the same service as Facebook:
Source: Florian Bodoky
Request to memorialise profile
Request to delete profile
X (formerly Twitter)
At X, you can submit a request to delete a profile here.
LinkedIn asks for a date of death, death certificate and last employer information. You then fill in a form to request the profile to be deleted.
Depending on their job and online activity, the deceased person may show up in Google search results. It’s a good idea to Google the name and see what results, if any, this produces.
If anything appears that you want to have deleted, contact the site operators and ask for this to be done. If the deceased person had their own website, you can contact the host. If you don’t know the host, you can find out here (for Switzerland). Once information from a website is deleted, it will no longer show up in Google search results.
If this fails, Google offers its own privacy form, where you can submit a request for deletion of search results. However, Google – just like most other providers – requires some legal documents.
Source: Florian Bodoky
Google’s information is vague: «If you are representing someone else, you must have the legal authority to act on their behalf.» In Switzerland, this means you’ll need to provide a certificate of inheritance or a notarised document proving that you’ve been appointed as executor.
Cancelling subscriptions
Digital subscriptions such as audio or video streaming can be cancelled in the account with just one click. However, if you don’t know the access data, you need to contact the respective customer service of Spotify, Netflix and the like.
Theoretically, however, you could just ignore subscriptions, as these services are usually tied to a credit card. If the credit card account is blocked or closed, the service will no longer be able to debit the amount and, as a result, the account will be blocked. Not the most elegant, but a functional solution.
Header image: Shutterstock
I've been tinkering with digital networks ever since I found out how to activate both telephone channels on the ISDN card for greater bandwidth. As for the analogue variety, I've been doing that since I learned to talk. Though Winterthur is my adoptive home city, my heart still bleeds red and blue.
