Digital Legacy Guide: Managing Online Accounts, Devices and Digital Assets After a Death

Most guides to digital legacy start with the platforms. This one starts with the device, because in practice, the device is where most families get stuck.

The reason is Multi-Factor Authentication, commonly called MFA or two-step verification. Even if you know someone's password, most accounts now require a second layer of proof: a code sent by text message, a push notification, or a code from an authenticator app (like Google Authenticator or Microsoft Authenticator). That second factor almost always goes to their phone.

If the phone is wiped, returned to a network provider, or the SIM is cancelled, you lose access to that second factor. At that point, you are locked out of most accounts regardless of whether you have the password. Getting back in without MFA typically requires a formal request with legal documents, which can take weeks or months.

What to do with the phone

Keep the phone charged and do not reset it. If it has a passcode you do not know, do not attempt too many guesses, as most devices will lock permanently after repeated failed attempts (Apple devices disable after 10 incorrect tries).

If a family member's fingerprint or face was already registered on the device (some couples and parents do this), use it now to unlock the phone and access accounts before the device locks again due to inactivity. Once inside, you can view authenticator apps, read SMS codes, and access email. Consider disabling MFA on important accounts while you have access, or changing the recovery phone number to your own.

Keep the SIM card active

Contact the mobile provider and explain the situation. Ask them to keep the number active on a basic tariff for the time being. You need the number to receive SMS verification codes. Some providers will allow you to transfer the number to a new SIM in your name if you provide a death certificate. This is particularly useful if the phone itself is locked.

Do not port the number away or cancel the contract until you have finished dealing with all online accounts. This could take several weeks.

Check for a password manager

If you can get into the phone, check for password manager apps such as 1Password, Bitwarden, LastPass, or the built-in Keychain (Apple) or Google Password Manager. A single master password or biometric unlock could give you access to every stored login. This is often the fastest route to resolving the entire digital estate.

Since December 2025, the legal position on digital assets in England, Wales, and Northern Ireland has changed significantly. The Property (Digital Assets etc) Act 2025 formally recognises that certain digital assets, including crypto-tokens and non-fungible tokens (NFTs), can be treated as personal property under UK law.

Previously, digital assets occupied a grey area. They did not fit neatly into the two traditional categories of personal property (things you can physically possess, and debts or contractual rights). Courts had started to treat them as property in individual cases, but there was no statute confirming this.

The 2025 Act creates what lawyers call a "third category" of personal property. In practical terms, this means:

For executors: digital assets that qualify as property under the Act are part of the Estate. They can be included in the Grant of Probate and distributed according to the will or intestacy rules, just like a bank account or a piece of jewellery.

When dealing with platforms: you can now frame your request not as asking for "access to an account" but as requesting property belonging to the estate. This gives you a stronger legal footing, particularly when dealing with the legal teams at large technology companies.

For cryptocurrency on exchanges: the Act strengthens the position that balances held on custodial exchanges like Coinbase or Binance are debts owed by the exchange to the estate, similar to a bank balance. The exchange holds the assets on your behalf, and the estate has a legal claim to them.

What the Act does not do: It does not override the terms of service of individual platforms. Apple, Google, and Meta still have their own bereavement policies, and the Act does not force them to hand over login credentials. It also does not tell you how to recover a lost private key for a cryptocurrency wallet. And it does not apply in Scotland, where the Scottish Government is consulting separately on similar provisions.

Each major platform handles bereavement differently. What they have in common is that none of them will give you the deceased's password. They will either provide data as a download, close the account, or memorialise it. In every case, you will need a death certificate and proof of your identity.

Apple (iCloud, Photos, Messages, App Store)

Apple offers two routes depending on whether the deceased set up a Legacy Contact.

If a Legacy Contact was set up: The designated person uses their access key (generated when the Legacy Contact was created) to request the deceased's data through Apple's Digital Legacy portal. Apple provides a downloadable archive of iCloud data including photos, emails, notes, and files. This typically takes 1 to 4 weeks.

If no Legacy Contact was set up: You will need a court order naming you as the rightful person to access the data, along with a death certificate and your own ID. Under the 2025 Act, you may be able to strengthen your application by framing digital files stored in iCloud as property of the estate. Apple will not unlock the device itself or provide passwords. They provide data as an archive only.

Important: Apple devices with Activation Lock cannot be reused without the original Apple ID credentials or proof of ownership. If you want to reuse or sell the device, you will need to contact Apple Support with the death certificate and proof of purchase.

Contact: Apple Support (call via the Apple Support app or website). There is no single bereavement email address; the process is handled through the standard support channels.

Google (Gmail, Drive, Photos, YouTube)

Google provides three options.

Inactive Account Manager: If the deceased set this up in advance, Google automatically shares data with or deletes the account after a set period of inactivity (between 3 and 18 months, chosen by the account holder). Designated contacts receive a notification and access to selected data.

Request access to data: You can submit a formal request to Google with a death certificate, your government ID, proof of your relationship to the deceased, and the Gmail address. Google reviews each request individually and may provide a data download. This typically takes 2 to 6 weeks. Google's process is here: support.google.com/accounts/troubleshooter/6357590

Request account deletion: If you do not need the data but want the account closed, Google can do this with the same documentation.

YouTube channels with revenue: If the deceased earned advertising income from a YouTube channel, this is a financial asset. Contact the YouTube Partner Programme support team separately, as the channel may continue to generate revenue that belongs to the estate.

Meta (Facebook, Instagram, WhatsApp)

Meta offers memorialisation or removal.

Memorialise the account: Facebook adds a "Remembering" label above the person's name. Friends can still post tributes. If the deceased set up a Legacy Contact, that person can manage certain aspects of the memorialised profile (pinning posts, responding to friend requests). Instagram accounts can also be memorialised. WhatsApp accounts cannot be memorialised and are simply deactivated.

Remove the account: You can request permanent deletion of a Facebook or Instagram account by submitting proof of death (a death certificate, obituary, or memorial card) and the profile URL. This typically takes 1 to 2 weeks. Request removal on Facebook

Important: Downloaded photos and messages are not available to family members unless the deceased set up a Legacy Contact or you have direct access to the account via their device.

Microsoft (Outlook, OneDrive, Xbox)

Microsoft requires a formal request with a death certificate, a court order, your ID, and the Microsoft account email address.

Request data: Microsoft will provide a download of data from Outlook, OneDrive, and associated services. This can take 4 to 8 weeks. Under the 2025 Act, files stored in OneDrive may be characterised as property of the estate, which could support your application.

Close the account: If you do not need the data, you can request account closure with the same documentation.

Xbox and gaming: If the deceased had an Xbox account with purchased games, in-game items, or currency, these may have monetary value. Mention this specifically in your request.

Contact: Microsoft bereavement support

LinkedIn

LinkedIn offers only one option: permanent removal of the profile.

Remove a profile: Submit the profile URL, proof of death, and details of your relationship to the deceased. This typically takes 1 to 2 weeks. linkedin.com/help/linkedin/ask/TS-RDMLP

LinkedIn does not provide data downloads to family members. If you need information from the profile (such as employment history for probate purposes), take screenshots before requesting removal.

Cryptocurrency is the area where the most money can be lost permanently, and where families need to be most careful. The rules depend entirely on how the deceased held their crypto.

Custodial assets: Exchanges (Coinbase, Binance, Kraken, etc.)

If the deceased held cryptocurrency on an exchange, the exchange acts as a custodian, similar to a bank. Under the Property (Digital Assets etc) Act 2025, these balances are recognised as property belonging to the estate. The exchange effectively owes the estate the value of those assets.

Contact the exchange's bereavement or legal team with a death certificate, Grant of Probate (or Letters of Administration), and your ID. Each exchange has its own process, but the legal position is straightforward: these are estate assets, and the exchange must cooperate with the legal personal representative.

Check bank statements for recurring payments to exchanges. Not everyone tells their family about crypto holdings.

Non-custodial assets: Hardware wallets and software wallets

This is where things become difficult. If the deceased held cryptocurrency in their own wallet (a hardware device like a Ledger or Trezor, or a software wallet on their phone or computer), there is no company to contact. The assets are controlled entirely by a private key or a recovery phrase (sometimes called a seed phrase), typically 12 or 24 words written down on paper or stored in a password manager.

Without the recovery phrase or private key, the assets are permanently inaccessible. No court order, no Act of Parliament, and no technology company can retrieve them. This is how cryptocurrency works by design.

Where to look for recovery phrases: Check the deceased's safe, filing cabinet, or any physical documents kept with important papers. Look in password managers. Check for any notes labelled "seed phrase," "recovery words," or "backup." Some people store them in sealed envelopes with their will.

NFTs, tokens, and other digital financial assets

The same principles apply. If held on an exchange or marketplace, contact the platform. If held in a personal wallet, you need the private key. The 2025 Act strengthens the legal position that these are property of the estate, but the practical challenge of access remains the same.

Many digital assets have no physical trace. There is no letter from the bank, no card in a wallet. The only evidence might be a transaction buried in an email inbox or a monthly charge on a bank statement.

If you have access to the deceased's email, search for keywords that commonly appear in financial communications from digital platforms:

Payment and revenue: "royalty," "payout," "earnings," "payment received," "withdrawal," "deposit," "invoice," "Stripe," "PayPal," "Wise," "Revolut"

Subscriptions and assets: "renewal," "subscription," "domain," "hosting," "your account," "annual fee," "storage plan"

Crypto and investment: "wallet," "exchange," "KYC," "verification," "Coinbase," "Binance," "Ledger," "eToro," "trading"

Content and intellectual property: "ad revenue," "monetisation," "affiliate," "royalty statement," "Kindle Direct Publishing," "Shutterstock," "YouTube Partner"

Also check bank and credit card statements for recurring charges you do not recognise. Even small monthly payments (to web hosting, domain registrars, or app subscriptions) can point to digital assets with value. A domain name, a monetised blog, or a library of stock photos might be worth more than you expect.

Specific places families often miss

• YouTube channels may earn ongoing advertising revenue. If the deceased had a channel with regular views, contact the YouTube Partner Programme.
• Gaming accounts (Steam, PlayStation, Xbox) may contain hundreds of pounds in purchased games, though most platform terms of service consider these non-transferable licences rather than owned property.
• Domain names registered through services like GoDaddy, Namecheap, or 123 Reg may have commercial value, particularly short or memorable names.
• Online marketplaces like eBay, Etsy, Amazon Seller, or Vinted may have open orders, pending payments, or stock.
• Cloud storage in Google Drive, Dropbox, or iCloud may contain intellectual property, unpublished manuscripts, photography archives, or business records relevant to the estate.

Most major technology platforms are US-based companies. While they generally cooperate with UK Grants of Probate and Scottish Confirmations, this is not always straightforward.

Some platform legal teams, particularly Apple and Microsoft, have been known to query whether a UK probate document gives sufficient authority over data held on US servers. This does not happen in every case, but it can cause delays for larger or more complex estates.

If you encounter resistance from a US-based platform, there are a few practical steps to consider.

Ask your solicitor about an apostille. An apostille is an international authentication certificate (issued by the Foreign, Commonwealth and Development Office in the UK) that certifies a legal document for use abroad. Adding an apostille to your Grant of Probate makes it easier for a US legal team to accept.

Request a "Letter of Authority" from your solicitor. Some practitioners prepare a specific letter addressed to the platform's legal department, referencing the Grant of Probate, the deceased's account details, and the legal basis for the request (including the 2025 Act where relevant). This can be more effective than simply uploading documents to an online form.

Be prepared for separate processes. Some platforms handle UK requests through a UK or European office, while others route everything through their US headquarters. Response times vary accordingly.

For most estates, the standard bereavement process at each platform will work without any of this. But if the estate involves significant digital assets, multiple platforms, or any platform pushback, having a solicitor who understands both UK probate and digital assets can save considerable time.

The single most valuable thing anyone can do for their family is to make their digital life accessible in advance. This does not mean sharing passwords (which often violates platform terms of service). It means using the built-in legacy tools that the major platforms already offer.

• Apple Legacy Contact: Settings > [Your Name] > Sign-In & Security > Legacy Contact. You give someone an access key. They use it after your death to request your data.
• Google Inactive Account Manager: myaccount.google.com > Data & Privacy > Make a plan for your digital legacy. You choose trusted contacts and what data they receive after a period of account inactivity.
• Meta Legacy Contact: Facebook Settings > Memorialization Settings. You choose someone to manage your memorialised account.

Keep a list of accounts (without passwords) in a sealed envelope with your will, or in a password manager that your executor knows about and can access. Include email addresses, phone numbers associated with accounts, and the names of any exchanges or wallets holding financial assets. For more on the physical side of organising belongings, see our guide to sorting out personal belongings after a death.

Write down cryptocurrency recovery phrases and store them securely, separate from your devices. Tell your executor (or the person you trust most) where to find them. If they are lost, the assets are lost.

Don't rush to close everything. Email accounts in particular may continue to receive important correspondence, password reset links, and financial statements for months after the death. Keep the primary email account open until the estate is fully settled.

Social media grief is real. Seeing a deceased person's profile appear in "memories" or "people you may know" can be deeply distressing. If you want to memorialise or remove profiles, do it when you feel ready, not because you feel you should.

Terms of service are not the final word. Platforms often have more flexibility than their published policies suggest, particularly when you speak to a bereavement specialist rather than a general customer service agent. Be patient, be clear about what you need, and escalate if necessary.

Small accounts add up. A Spotify subscription, an iCloud storage plan, three streaming services, and a gym app can easily total over £50 a month. Check bank statements and cancel what is no longer needed. Our guide to closing utility accounts covers the process for broadband, mobile, and other recurring services.

• AfterLoss: www.afterloss.uk - Free bereavement administration tool that helps you track and manage account closures across providers.
• GOV.UK - Tell Us Once: www.gov.uk/after-a-death/organisations-you-need-to-contact - The government service that notifies multiple departments of a death in one go (does not cover private companies or technology platforms).
• Law Commission - Digital Assets Report: lawcom.gov.uk/project/digital-assets - The legal background to the Property (Digital Assets etc) Act 2025.
• ABI Unclaimed Policies Index: www.abi.org.uk - Free search for unclaimed insurance and financial products.

If you are dealing with a digital estate right now, start with the phone. Secure the device, keep the SIM active, and check for a password manager. Then work through the platforms in order of priority: email first (it unlocks everything else), then financial accounts, then social media.

If you are planning ahead, set up legacy contacts on Apple, Google, and Meta today. It takes five minutes for each one and could save your family weeks of paperwork.

• What to do when someone dies
• How to apply for probate
• Redirecting post after a death
• Personal belongings after a death