Digital legacy · The lawful routes · UK 2026

What happens to your digital life when you die?

An average UK adult now holds more than ninety online accounts — email, banking, pensions, photos, subscriptions — most of them resting on one password manager and one recovery email address.

Almost none of it is in your will. None of it appears in a probate inventory.

And here is the part almost nobody knows: if your family logs into your accounts after your death using your passwords — even to help, even with everyone's blessing — they are very likely making unauthorised access under the Computer Misuse Act 1990 — unlawful even when the intention is simply to help.

There is a lawful route for every major platform. Setting each one up takes minutes and costs nothing. This guide walks through all of them.

Download the free brief (PDF)How it stays true over time

On this pageThe one lawThe password managerApple · Google · MicrosoftSocial mediaTwo-factor authenticationBanks, pensions, cryptoThe quarterly hourDownload the briefFAQ

§1

The one law that changes everything

The Computer Misuse Act 1990 makes it an offence to knowingly access someone else's accounts without authority — and after a death, that authority is rarely the family's to assume. Platform terms almost universally make login credentials personal and non-transferable. A will appoints your executor to administer the estate — it does not licence anyone to log in as you. A lasting power of attorney ends at death altogether.

The grieving spouse who opens a locked phone to reach the bank "just this once" is, in most circumstances, making unauthorised access.

This is not a theoretical risk to frighten you with — banks and platforms rarely prosecute families. The real cost is practical: accounts accessed this way get flagged, frozen, and locked, usually at the worst possible moment, and the formal recovery routes become slower once a platform's fraud systems have fired. The lawful mechanisms below exist precisely so nobody in your household is ever standing at that fork.

§2

The password manager: the central key

One decision does more than everything else on this page combined: put a password manager at the centre, and seal its recovery route. Most consumer managers (1Password, Bitwarden, Dashlane) issue a one-page Emergency Kit at setup. Print it, sign it, seal it in a tamper-evident envelope, and store it with your solicitor or in a bank deposit box.

The kit is lawful to use after your death because you configured the access and named its conditions while you had capacity — that is the entire legal distinction between an Emergency Kit and a whispered master password.

1Password (Families) and LastPass go further with Emergency Access: a nominated contact can request access, and if you don't veto within a waiting period you set — typically 7–30 days — access is granted. This is the most lawful, lowest-friction handover route that exists in 2026.

§3

Apple, Google, Microsoft: the platform legacy mechanisms

Settings → Apple ID → Legacy Contact

Apple Legacy Contact

Nominate one or more people; each gets an Access Key. After a death, Access Key + death certificate unlocks iCloud photos, notes, files and messages (not Keychain passwords, not Apple Pay).

Ten minutes · Free

myaccount.google.com → Data & Privacy

Google Inactive Account Manager

Set an inactivity window (3, 6, 12 or 18 months), nominate up to ten trusted contacts, choose exactly which services they may receive, optionally auto-delete afterwards.

Fifteen minutes · Free

No self-serve equivalent

Microsoft

Next of kin must contact Microsoft Support with a death certificate, a will, and proof of relationship. You can't pre-configure it, but you can record that this is the route, so your executor doesn't burn a week discovering it.

Record the route now

§4

Social media: memorialise or delete — choose now

Facebook / Instagram offer a Legacy Contact who can manage a memorialised profile (never read messages) — or you can set the account to delete on memorialisation. It's a one-time choice; make it deliberately.

LinkedIn is request-based: a family member files a form with the obituary or death certificate. X only supports deactivation by immediate family — if an account's archive matters to you, download it while you can; nobody can after.

§5

The silent blocker: two-factor authentication

The single most common cause of executor stalling in 2026 is not a missing will — it's a 2FA code arriving on a locked phone. The bank cannot release funds, the email cannot be recovered, the legacy mechanism cannot be triggered, because every route resets through a device nobody can open.

The fix costs nothing: use an authenticator app with cloud backup (1Password, Authy, Google Authenticator with sync) so codes survive the phone, and never rely on SMS-only 2FA for anything that matters. If you use hardware keys, register two — one on you, one sealed in the Emergency Kit. A single hardware key is a complete account lock waiting to happen.

§6

Banks, pensions, crypto: where the rules invert

For banks, brokers, pensions and insurers, the rule inverts: never use the deceased's credentials, even though the family could. Every UK institution has a formal bereavement team, and it is faster, kinder, and lawful — what your records need is the list of institutions, not the logins.

Crypto is the one exception with no bereavement team anywhere: a seed phrase nobody can find is an asset that has ceased to exist. Write it on metal or archival paper, seal it, store it with your solicitor — and record only that it exists, never the phrase itself.

§7

The quarterly hour that makes any of this work

Digital legacy doesn't fail at setup. It fails eighteen months later — the Legacy Contact silently dropped during a phone upgrade, the recovery email now defunct, the Emergency Kit moved house without anyone updating the note that says where it lives. Once a quarter, in under an hour: verify the Legacy Contact, check the Inactive Account Manager's contacts, confirm Emergency Access is still configured, sweep one bank statement for subscriptions, confirm the recovery email still opens.

This is the point where a document stops being enough — a static PDF can't tell you the Legacy Contact got unset.

The map is free. Keeping it true is the work.

This guide — and the printable brief below — give you the full architecture. Household Continuity Dossier membership (£195 first year, then £99/year) holds it as a living record: your platforms, your named contacts, your Emergency Kit location, reviewed annually, with the Governance Letter issued when a circumstance changes.

See what the Household Continuity Dossier holds →

§8

Download the brief

The Digital Legacy Brief is the printable companion to this guide — the same architecture as a fill-in document, worked through the Pemberton-Walsh household example. Free, no account required.

Digital Legacy Brief (PDF)

Working for a hospice, charity, council or carers' service? You're welcome to link the brief, print it, or put it in a bereavement pack — free, no permission needed, nothing expected in return. See everything that's free

FAQ

Digital legacy questions, answered.

In almost all cases, no.

Knowingly accessing another person's accounts without authority is an offence under the Computer Misuse Act 1990, and after a death that authority is rarely there to rely on: platform terms make credentials personal and non-transferable, a will appoints an executor rather than transferring logins, and an LPA ends at death.

The lawful routes are the platform legacy mechanisms (Apple Legacy Contact, Google Inactive Account Manager) and a properly sealed password-manager Emergency Kit that you configure in advance.

The accounts themselves generally don't appear in a probate inventory — but the assets inside them (bank balances, crypto, business revenue, IP royalties) are estate assets.

That mismatch is exactly why executors miss them: the value is real, the paperwork trail isn't.

With a Legacy Contact (Apple) or Inactive Account Manager (Google) configured, your nominated person receives lawful access with a death certificate.

Without one configured, recovery ranges from slow to impossible — for most households the photo archive is the single most emotionally significant digital asset, and the most fragile.

Crypto has no bereavement team.

If the seed phrase can't be found, the asset is gone permanently. Store the phrase physically (metal or archival paper), sealed, with your solicitor or in a deposit box — and record its existence, never its contents, in your household records.

There's no separate legal instrument called a digital will in England & Wales.

What works is ordinary estate planning plus the platform mechanisms above, plus a routing document — like the free brief on this page — that tells your executor where everything lives and which lawful door opens it.

Read alongside this