Post-Death, Who Controls Your Digital Assets? And How to Prepare Now.
Adv. (Dr.) Prashant Mali
“Non exiguum temporis habemus, sed multum perdidimus.”
It is not that we have a short time to live, but that we waste much of it.
— Seneca, De Brevitate Vitae
Here is an uncomfortable thought experiment. Tomorrow you are gone. Your heart stops, but your monthly bills do not. Netflix keeps charging your card. Your cloud storage keeps auto-renewing. Somewhere, a server dutifully wishes you a happy birthday every year, forever, like a well-meaning ghost who never got the memo. Your family, meanwhile, is locked out of your phone, staring at a login screen that politely asks for a code sent to — you guessed it — your phone.
We spend our lives building a digital estate: photos of children who have since grown up, years of email, business documents, a crypto wallet, a decade of memories. And then most of us leave the keys to this kingdom in exactly one place — our own head — which is, statistically speaking, the least reliable vault available.
This is not a morbid post. It is a practical one, written by a lawyer who has watched too many grieving families discover that love does not open a two-factor authentication prompt. The philosophers called it memento mori — remember that you will die. The modern version is gentler and more bureaucratic: remember to write down your passwords.
The uncomfortable truth: you are a tenant, not an owner
Why your family can inherit your house but not your Gmail
When you die, your flat, your car and your gold pass to your heirs under ordinary succession law. Your Instagram does not — at least not automatically. The reason is buried in the terms of service you agreed to without reading (all of us; no judgement).
Most digital accounts are not property you own. They are a licence to use a service, granted to you personally. Apple’s own terms have historically stated that there is no right of survivorship in an Apple Account. In plain English: the account was rented to you, and the lease was never meant to be handed down.
This is why families end up litigating. Consider John Ajemian, a Massachusetts man who died in a cycling accident without a will. His siblings, appointed to administer his estate, simply wanted access to his Yahoo email to identify his assets and arrange his affairs. Yahoo refused, invoking a 1986 privacy statute. The fight lasted the better part of a decade before America’s courts sorted it out.
The person who plans for their digital death in an afternoon spares their family a legal battle that can last years.
The good news: nearly every major platform now lets you appoint a successor in advance. The catch is that almost nobody does it. Let us fix that.
What the law actually says
A short world tour, because the courts have been busy
India - the new frontier
India has, for the first time, written the digital afterlife directly into statute. Section 14 of the Digital Personal Data Protection Act, 2023 creates a Right to Nominate: you may nominate another individual who, in the event of your death or incapacity, may exercise your data-protection rights on your behalf — access, correction, erasure and grievance redressal. The mechanism is prescribed under the Digital Personal Data Protection Rules, 2025. It is a quietly revolutionary idea: your data rights no longer die with you.
But note the limits. Section 14 lets your nominee exercise rights over your data; it does not, by itself, hand your heirs the contents of every account or the value inside it. For that we still lean on wills and succession law under the Indian Succession Act, 1925, and on each platform’s own tools. There is also a deeper tension the courts will wrestle with: in K. S. Puttaswamy v. Union of India (2017) the Supreme Court held privacy to be a fundamental right — yet privacy is classically treated as personal and extinguished at death. Whose privacy survives, and for whom? Scholars call this post-mortem privacy, and India is about to become a live laboratory for it.
Germany — your Facebook is inheritable
The clearest judicial answer in the world came from Germany. After a 15-year-old girl died under a train, her parents sought access to her Facebook account, hoping to learn whether it was accident or suicide. Facebook had “memorialised” the account and refused. In BGH, 12 July 2018, III ZR 183/17, the German Federal Court of Justice ruled that a social-media contract passes to the heirs by universal succession (Section 1922(1) of the German Civil Code), exactly like a paper diary or a bundle of letters. The court added a memorable point: the GDPR protects the living, not the dead, so data-protection law was no shield. A 2020 follow-up made clear that “access” means real, usable access — not a USB stick full of PDFs.
United States — consent is king
In Ajemian v. Yahoo!, Inc., 478 Mass. 169 (2017) (U.S. Supreme Court review declined, 2018), the court held that the federal Stored Communications Act does not bar a provider from disclosing a deceased user’s emails; a personal representative can supply the “lawful consent” the statute requires. Most U.S. states have since adopted the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which lets an executor manage your digital assets — but usually only if you consented in advance, through a will or the platform’s own tool.
Three legal systems, one lesson: courts reward the person who left instructions and punish the family that must guess. Litigation is a terrible substitute for a fifteen-minute setup.
The 12-step Digital Legacy Playbook
You can finish most of this in a single weekend
1. iPhone & Apple users: set a Legacy Contact
Settings > [your name] > Sign-In & Security > Legacy Contact
Assign someone you trust. Apple generates an access key linked to them. When they later present that key together with your death certificate, Apple opens up the data in your account — photos, files, mail, notes, messages, device backups.
One honest caveat, because accuracy matters more than hype: a Legacy Contact does not get everything. Apple deliberately excludes items in your iCloud Keychain (saved passwords, passkeys, payment cards) and licensed media and subscriptions. Translation: this feature preserves your memories and documents, but your passwords must be handled separately — which is exactly why Step 3 exists. Skip this setup, and your family may spend months in bureaucratic limbo with no guarantee of success.
2. Google accounts: use Inactive Account Manager
myaccount.google.com/inactive
This is Google’s dead-man’s switch, and it is elegant. You set a timer for how long Google should wait after you go silent. Then you name people and decide exactly what each one receives — one person gets Gmail, another gets Drive, another gets Photos. You control the split like a will for your inbox.
Before doing anything drastic, Google checks with you first (a text, an email). No response for long enough, and the people you chose gain access automatically. Set-and-forget, in the best sense.
3. Your password manager: the master key
Everything else depends on this one. Your password manager is the ring that holds every other key.
● Bitwarden, LastPass, Dashlane all have an Emergency Access setting tucked into account options. Add a contact, set a waiting period (around 7 days), and if you stay silent past it, the vault opens for them.
● 1Password works differently: print the Emergency Kit PDF (it holds your sign-in address, account details and Secret Key) and store the paper somewhere physically safe.
A password manager without an emergency plan is a treasure chest thrown into the sea. Beautiful. Waterproof. Utterly lost.
4. Social accounts: decide who speaks for you
Facebook: Settings > Accounts Centre > Personal Details > Account Ownership and Control > Memorialisation Settings
Facebook lets you either appoint a Legacy Contact or arrange for the account to be automatically deleted at death. Note the boundary the law and the platform both draw: your chosen contact may manage the public profile, but cannot read your private messages or impersonate you. Your inbox stays yours, even in memoriam — an echo of the very telecommunications-secrecy debate the German court had to resolve.
5. The phone PIN: the detail everyone forgets
This is the quiet giant. Almost every two-factor authentication code in your life lands on your phone. Without the PIN, your family cannot get past the login screen of anything — not the bank, not the email, not the account that would have unlocked all the others.
You can plan your entire digital estate perfectly and have it defeated by a four-digit number nobody knows.
Tell one trusted person. Write it down. Keep it with your important documents. This single step quietly unlocks half the list above.
6. The one-page document that ties it together
Gather the essentials on a single sheet:
● Where the password manager lives, and how to reach it (emergency access, or the printed kit)
● Where seed phrases and recovery codes are physically stored
● The phone’s PIN
● Who handles Apple and who handles Google
● Any account holding real money or value
Print two copies. One under lock and key; one with a person you completely trust. Review it every year — an annual ritual, like a health check-up for your afterlife. A template is provided further below.
7. Financial accounts: assume nobody knows
Most people quietly believe their family knows where the money is. Most people are wrong. List every bank account, brokerage, retirement fund, insurance policy and loan. You need not write down the passwords — just document what exists and where. An account nobody knows about might as well not exist.
8. Bills & subscriptions: the payments don’t stop
Death is not a cancellation event, at least not to a billing system. The mortgage, the rent, the utilities, the phone plan, the streaming services, the software licences — they all keep charging. List every recurring payment and where it is charged. It spares your family a slow drip of small stresses at the worst possible time. (And yes, it stops that ghostly Netflix subscription from streaming into eternity.)
9. Crypto: the assets that vanish forever
A crypto wallet without its recovery phrase is often gone for good — no bank, no helpline, no appeal. Bitcoin, Ethereum, hardware wallets, seed phrases: document what exists and where the recovery information is kept. Billions of dollars in crypto have been lost simply because the one person who knew the seed phrase took it with them. Do not become a statistic in someone’s cautionary blog post.
10. Important contacts: who really runs your life
Your family may not know the people who quietly keep your world turning — your accountant, your lawyer, your financial advisor, your business partner, your employer. Names, phone numbers, emails. One page here can save weeks of confusion and a great deal of “who was he again?”
11. Physical assets: not everything is online
Property deeds, vehicle titles, safe-deposit boxes, jewellery, collectibles. The hardest assets to claim are the ones nobody knew existed. Document what exists and where it can be found.
12. Final instructions: the things passwords can’t hold
Some questions cannot be answered by a login. Who should manage your accounts? What should happen to your social profiles — memorialised, or deleted? Which subscriptions to cancel? Which digital memories to preserve, and which to let quietly fade? Write it down. Do not leave your most human decisions to guesswork.
Your one-page Digital Legacy Sheet
Copy this. Fill it in. Print two. Review yearly.
● Phone PIN / device passcode: ____________________
● Password manager — which one, and how to access (emergency contact set? / kit location?)
● Apple Legacy Contact: ______ | Google Inactive Account Manager: set? Y / N
● Seed phrases / recovery codes — physical location: ____________________
● Bank & investment accounts — institutions and account references
● Insurance & loans — policy / loan numbers and where held
● Recurring bills & subscriptions — what, and the card/account charged
● Crypto — wallets held and where recovery info lives
● Key contacts — lawyer, accountant, advisor, business partner, employer
● Physical assets — deeds, titles, safe-deposit box, valuables and their location
● DPDPA Section 14 nominee — named? To whom?
● Wishes — memorialise or delete social profiles; memories to preserve
● Location of the two printed copies of this sheet
A closing thought, because you love philosophy
On dying well in an age that never forgets
The Stoics practised memento mori not to be gloomy but to live deliberately. Our era has quietly added a second discipline — call it memento data. We now leave behind not only a body and an estate, but an archive: a searchable, self-renewing, subscription-paying version of ourselves that keeps running after we stop.
The philosopher’s paradox is that the archive both remembers us and, if unmanaged, betrays us — charging cards no one can cancel, guarding photos no one can reach, whispering birthday reminders into an empty room. To prepare your digital death is not to surrender to it. It is the final, generous act of an examined life: to leave the people you love a clear map instead of a locked door.
The best time to make your digital legacy plan was the day you got your first smartphone. The second-best time is this weekend.
Frequently Asked Questions
Can I just put my passwords in my will?
Please don’t. A will, once probated, can become a public document — so your passwords could end up on the record for anyone to read, and by the time probate finishes, the passwords may be stale anyway. Instead, reference in your will that a separate, private “digital assets memorandum” exists, and keep the actual credentials in your password manager and one-page sheet.
What is the DPDPA “Right to Nominate,” in one line?
Under Section 14 of India’s Digital Personal Data Protection Act, 2023, you can nominate a person to exercise your data-protection rights (access, correction, erasure, grievance) if you die or become incapacitated — the first time Indian law has directly recognised a digital afterlife.
Does the DPDPA nominee automatically get all my money and accounts?
No. The nominee exercises your data rights. Ownership and value still flow through your will and succession law, and access to specific accounts still depends on each platform’s tools (Apple Legacy Contact, Google Inactive Account Manager, and so on). Think of Section 14 as one important instrument in the orchestra, not the whole symphony.
If I set an Apple Legacy Contact, does my family get literally everything?
Almost, but not quite. They get photos, messages, notes, files and backups. They do not get your iCloud Keychain passwords and passkeys, saved payment cards, or purchased media and subscriptions. That gap is precisely why you still need a password manager plan and a one-page sheet.
Can my heirs read my private messages after I die?
It depends on the platform and the country. Facebook’s Legacy Contact expressly cannot read private messages. Germany’s Federal Court, by contrast, ordered full account access for heirs as a matter of inheritance law. India’s position is still developing. The safe assumption: what you want preserved or shared, arrange yourself, in advance.
What happens to my crypto if I never wrote down the seed phrase?
Bluntly — it is likely gone forever. There is no “forgot password” link for a self-custodied wallet. This is the single most unforgiving item on the list, so treat the seed phrase like the crown jewels: recorded, secured, and its location known to one trusted person.
How often should I update all this?
Once a year, and after any big change — a new bank, a new phone, a new relationship, a new business. Tie it to a date you’ll remember (a birthday, a new financial year). An out-of-date plan can be almost as unhelpful as no plan.
Isn’t writing everything down a security risk?
A managed risk beats an unmanaged catastrophe. The goal is not to scatter secrets, but to concentrate them safely: strong password manager + emergency access, plus one physical sheet under lock and key and one with a person you trust completely. You are trading a small, controlled exposure for a very large, avoidable disaster.
References & further reading
Statutes & Rules
The Digital Personal Data Protection Act, 2023 (India), Section 14 (Right to Nominate) & the DPDP Rules, 2025.
The Indian Succession Act, 1925.
The Information Technology Act, 2000 (India).
Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), Uniform Law Commission, 2015 (USA).
Stored Communications Act, 18 U.S.C. Sections 2701 et seq. (USA).
Bürgerliches Gesetzbuch (German Civil Code), Section 1922(1) — universal succession.
Case Law
K. S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (Supreme Court of India) — privacy as a fundamental right.
Bundesgerichtshof (BGH), Judgment of 12 July 2018, III ZR 183/17; and BGH, III ZB 30/20 (2020) — social-media accounts are inheritable; heirs entitled to full access.
Ajemian v. Yahoo!, Inc., 478 Mass. 169 (2017), cert. denied (U.S. 2018) — personal representative may give lawful consent under the Stored Communications Act.
Scholarship
Mali, Dr Prashant and G, Aswathy Prakash (2019) "Death in the Era of Perpetual Digital Afterlife: Digital Assets, Posthumous Legacy, Ownership and its Legal Implications," National Law School Journal: Vol. 15: Iss. 1, Article 8.
Available at: https://repository.nls.ac.in/nlsj/vol15/iss1/8
L. Edwards & E. Harbinja, “What Happens to My Facebook Profile When I Die?: Legal Issues Around Transmission of Digital Assets on Death,” in Digital Legacy and Interaction (Springer, 2013).
E. Harbinja, “Post-mortem Privacy 2.0: Theory, Law, and Technology,” 31 International Review of Law, Computers & Technology 26 (2017).
D. McCallig, “Facebook After Death: An Evolving Policy in a Social Network,” 22 International Journal of Law and Information Technology 107 (2014).
Recent Case, “Ajemian v. Yahoo!, Inc.,” 131 Harvard Law Review 2081 (2018).
“Beyond the Grave: A Fiduciary’s Access to a Decedent’s Digital Assets,” Cardozo Law Review.
This article is for general educational purposes and reflects the position as of 2026. Platform settings and menu paths change; verify each step on the current version of the app or site. It is not legal advice, and no advocate–client relationship is created by reading it. For guidance on your specific estate, data-protection nomination under the DPDPA, or a bespoke digital-legacy plan, consult a qualified professional.