Your digital legacy: what to prepare before anyone needs it

We spend our working lives recovering data from devices whose owner has died. Almost every case has the same shape: something could have been arranged in half an hour while the person was alive, and instead it took their family months — or never happened at all.

This article is the other half of that work. It is what to do before.

Almost nobody has done this

The largest recent survey on the subject is Which?’s April 2024 study of 14,631 people . Its headline:

• 76% had made no plan of any kind for their digital assets after death
• 18% had left any directions about how to access their accounts
• 3% had made provision for digital assets in a will

The same survey found that 6% had already needed access to a dead person’s accounts. What they needed most was not photographs or social media — it was email (74%), because email is the key that resets everything else. Photos came second at 31%, Facebook a distant 24%.

That gap — three quarters of people with no plan, and a growing minority who already needed one — is the whole problem.

What it costs when nobody prepared

Germany, 2018. The parents of a 15-year-old girl who died at a Berlin underground station wanted access to her Facebook account to understand whether her death had been an accident. Facebook refused. They sued. On 12 July 2018 the Federal Court of Justice ruled in their favour: a social-media account passes to the heirs like a diary or a bundle of letters, under §1922 of the German Civil Code (BGH III ZR 183/17, press release 115/2018 ).

They won. It took three years and three courts.

Italy, 2021. A court in Milan ordered Apple to give the parents of a young man who had died in a road accident access to their son’s iCloud data — recipes and photographs they wanted to recover (Tribunale di Milano, Sezione I, order of 10 February 2021). Again: a win, obtained through a court, after the company had said no.

Businesses. The version we see most often is not dramatic at all. A company’s Microsoft 365 administrator dies, and the two-factor authentication for the admin account is bound to the phone in his pocket. Nobody did anything wrong. The company simply cannot get into its own systems, and Microsoft now requires a court order to release account content.

Note what these have in common: in every case the family or the company was entitled to the data. Entitlement was never the problem. Proving it, to an organisation with no obligation to make it easy, was.

What the platforms actually give you — and what they don’t

Three of the big providers have built tools for this. They work well, and they only work if you set them up in advance.

Apple — Legacy Contact. You nominate one or more people; each receives an access key, which they later submit together with a death certificate. The part families are rarely told, in Apple’s own words : inaccessible data includes “data stored in your iCloud Keychain (payment information, passwords, and passkeys)”.

Read that again, because it is the single best argument in this article for using a password manager. Your Legacy Contact gets your photographs. They do not get your passwords — and your passwords are what unlock everything that is not Apple’s.

Google — Inactive Account Manager. You set a period of inactivity, and Google lets you select up to 10 people to receive your data once it elapses — choosing which data each of them gets, or different data for different people. You can also have the account deleted automatically. It is the most flexible of the three, and it is entirely opt-in.

Meta — Legacy Contact. Worth understanding before you rely on it. A Facebook legacy contact can manage a memorialised profile — pin a post, update the picture, respond to friend requests — but they are not given access to the account itself, and private messages are not handed over. If what your family will want is your conversations, this is not the tool that provides them.

Microsoft. Effectively nothing. The old Next of Kin process is gone; content access now requires a court order.

Nobody publishes adoption figures for these tools, and any specific number you see quoted is almost certainly invented. The Which? figure of 18% is the best available proxy, and it suggests the answer is: very few.

What the law gives you in Spain

Spain does have a statutory answer, and it is better than most countries'.

Ley Orgánica 3/2018, article 3 lets heirs — and, notably, “las personas vinculadas al fallecido por razones familiares o de hecho”, people connected by family or de facto ties even if they inherit nothing — request access to a deceased person’s personal data.

Article 96, the derecho al testamento digital, extends that to online service providers, and article 96.1(b) is the useful part for planning: it expressly empowers the albacea testamentario or any person the deceased designated. That is the hook. You can name someone, in a will, to deal with your digital life.

Two things you should not be told wrongly:

• Article 96.3 promised a royal decree setting out how digital-will instructions would be proved and registered. As far as we can establish, almost eight years later it has never been enacted. There is no state register.
• Catalonia built a register and lost it. Llei 10/2017 created a Registre electrònic de voluntats digitals — the first in Spain. The Constitutional Court annulled it in STC 7/2019 (recurso 4751-2017), on the ground that creating a public register of private law is reserved to the State. The register never entered service. Articles 411-10 and 421-24 of the Catalan Civil Code survive, so the institution is alive — but the route runs through a notary, not a register.

For contrast: France has had this working since 2016. Article 85 of the Loi Informatique et Libertés lets anyone leave binding directives post mortem, general ones lodged with a certified trusted third party or specific ones with each provider, revocable at any time (CNIL ). It is the mechanism Spain announced and did not build.

The half hour that does most of the work

None of this requires a lawyer to begin.

1. Set up the legacy tools you already have. Apple Legacy Contact, Google Inactive Account Manager, Meta Legacy Contact. Fifteen minutes, all three, and they are free.
2. Solve passwords with a password manager, not a list. Bitwarden’s Emergency Access is a dead man’s switch: a trusted contact requests entry, and if you do not decline within a window you set, they get in automatically. 1Password’s Emergency Kit is a printed sheet — and 1Password’s own guidance is to give it to “someone you trust, like your spouse or someone in your will”.
3. Write an inventory, not credentials. Where things are, not how to open them: which bank, which email, which cloud, which domain registrar, which accountant. Where the recovery keys live. Where the crypto seed phrase is, if there is one.
4. Name a digital executor in your will. In Spain this is article 96.1(b) doing real work. Your notary can do it as part of an ordinary will.
5. Deal with the seed phrase now. A self-custody wallet with no recorded seed is unrecoverable — by us, by the developer, by anyone. Bitcoin lost this way is measured in the millions of coins: Chainalysis estimated 2.78–3.79 million BTC already permanently lost , though note that estimate dates from November 2017 and rests on assumptions its authors were open about.
6. Tell one person that any of this exists. The most carefully prepared digital estate is worthless if nobody knows to look for it.

One mistake worth avoiding

Do not write passwords into your will.

In England and Wales, once probate is granted, a will becomes a public document — anyone can order a copy from GOV.UK for £16 . A password written there is a published password.

Spain works differently: a Spanish will is not public, and copies are issued only to those with a legitimate interest. But the habit is still a bad one — wills are read out, copied, and circulated among heirs and their advisors, and credentials change while wills do not. Name a person and point at where the keys are kept. Never write the keys themselves.

If you would rather not do it alone

We help families and family offices with both halves of this: preparing a digital estate while there is time, and recovering one when there was not.

A one-hour consultation is €180, held personally in Spanish, English, Catalan or Italian, and credited in full against any engagement booked within thirty days. If the honest answer is that you can do this yourself in an afternoon, that is what we will tell you — and this article is most of the instructions.

Digital legacy: preparation and recovery →

Sources are linked inline. Figures are quoted with their survey size and date where the publisher provided them; where we could not verify a widely-repeated statistic, we have left it out rather than repeat it. This article is general information, not legal advice — for your own succession, work with your notary and your lawyer.