privacy_central

Dead End sign: How to access the data of the deceased?
Privacy28 Nov 201810 mins read

What happens to Facebook, Apple and Google data after death?

Our social media accounts are portraits of what we liked, thought and did - and that’s just the publicly accessible posts. What happens to our private messages and photos when we depart this mortal coil - and how might the law change that?

Natasha Stokes
Natasha StokesFeatures Editor

A dead man tells no tales – but his data is a whole different story. Facebook, Google, and Apple accounts can be treasure troves of personal insights developed through years of posts, messages and connections. Where previous generations might have collected scrapbooks, photographs and keepsakes for their stories to be passed on to grandchildren and their children, today, the digital trail left by increasingly online lives paints a far more detailed picture.

At least, that’s if bereaved family members are able to access password-protected accounts and devices.

Photos and video on Apple iPhones and MacBooks, for example, are notoriously difficult to access – terms and conditions for the iCloud storage service state that all content is deleted upon death, including one’s purchased music, videos and other media, and that family members only have the right to delete (not access) accounts upon production of a government-issued ID and their loved one’s death certificate.

Google accounts – those repositories of email, browsing activity, YouTube history and advertiser profiling – can similarly be deleted, but not accessed. To access photos or other content from a loved one’s Android phone to which they don’t have the password, people must make a request of the big G, accompanied by a death certificate and verified ID – though not all requests for content are granted.

There’s a good reason for this of course: Content in someone’s email or computer may contain messages or other information that they would never have wanted their loved ones to know, and social media companies rightly don’t want to be the decision-makers. Apple has even previously requested a court order to release an Apple ID to a grieving spouse.

Smartphone, access

Should families get automatic access to a deceased loved one’s smartphone?

Virtual graveyards on social media

Facebook is estimated to have over 30 million profiles that belong to deceased users. Some of these have been converted to memorial pages where friends can continue to post tributes, but the profile can no longer send posts, birthday reminders or be shown in friend suggestions or ads.

Facebook states that it will automatically memorialize the profile if it becomes aware of someone’s passing, but in order for a profile to be deleted, a death certificate must be sent to Facebook. (Someone with the password can of course continue to keep the account active.)

A legacy contact for someone’s profile, set prior to their death, has limited access to the profile, including memorializing it, updating the cover photo and pinning a message. However, they can’t read private messages or post on the account’s behalf – and neither can anyone else.

Facebook Legacy Contact

Legacy contacts can’t read private messages

When a 15-year-old girl was killed in Germany, her family asked Facebook for access to her memorialized profile so they could read her messages to understand if her death had been suicide or an accident. Facebook denied the request and the family subsequently opened the case in court. After a lower court ruled in favor of the family, a decision that Facebook appealed, a high court made the landmark ruling that heirs can access the social media accounts of deceased family.

While Facebook noted in a blog post that not sharing logins protects the privacy of the deceased persons’ friends, the case highlights the growing need for some regulation of how to transfer ownership of digital estates, which can have as much value as physical heirlooms and assets.

“There are other digital accounts that are more crucial to pass on, but social media, at this point, is about emotion,” says Gene Newman, editorial director at Everplans, a service that allows people to store and securely share access to sensitive information such as bank accounts, social media and email. “If there’s no plan in place then the social media provider goes by their own protocol and that’s usually not what a person would want.”

To delete or inherit a social account?

A new legal landscape is developing around online accounts and the rights of their owners. The Email Privacy Act could soon make it a U.S. felony to log into someone else’s email account, putting it on par with physical mail. Should someone pass away without nominating an executor of their digital estate, closing the 200 or so online accounts accumulated in a lifetime might get extremely complicated.

Many US states have already introduced legislation that allows trustees of someone’s estate, digital and otherwise, to access their digital accounts, while creating a “social media will” is on the U.S. government’s list of personal finance recommendations. France’s Digital Republic Act 2016 introduced greater protection for the data of the dead, with the ability for heirs to exercise these rights – by deleting or memorializing a profile for example – even in the absence of instructions from the deceased person.

In Australia, the state of New South Wales is reviewing whether a legal framework is required to regulate what happens to a deceased or incapacitated person’s social media and email accounts if they haven’t arranged for someone to manage or delete them.

“Email can be the key when it comes to closing down a digital estate,” Newman says. “If a person you trust doesn’t have access to an email account they have to go through official channels to access the account, which can be a hassle during a very difficult time.”

On the other hand, the messages, photos and likes within the confines of Facebook, Gmail, Instagram, or even Twitter and LinkedIn accounts could well unearth revelations that neither the deceased or their family would want known.

Facebook’s legacy contact feature and Google’s Inactive Account Manager go some way to addressing the sensitivity of the issue. These features allow users to share access to their accounts after their death, but not necessarily turn over their passwords or all their content. Prior to death, users can name a point of contact with some ability to manage the deceased’s accounts; decide if they want their accounts deleted; or whether some data – such as photos and videos, but not private messages – should be available to a named beneficiary.

With legislation, such tools could take legal precedence over any other provisions made – including the wishes of other family members, and even the provisions of their will.