Digital Estate Planning for Parents: Phones, Passwords, Photos

Digital estate planning for a parent means deciding, while they can still decide, who will be able to get into their phone, email, photos, password manager and paid accounts if they're incapacitated or die, and writing down where each thing is. For most families the core is short: know who can open the phone, turn on Apple's Legacy Contact or Google's Inactive Account Manager, set up emergency access in the password manager, and make sure the power of attorney and will actually mention digital assets. The binder records locations and names, never the passwords themselves.

None of this needs to be done in one sitting. But the order matters, and a few of the settings only work if your parent turns them on personally. If your parent has already died, our checklist for finding a deceased parent's accounts is the better place to start.

Why a will alone doesn't open an email account

Most families assume the executor can call Google or Apple with a death certificate and get in. That often works for closing an account. Getting the contents is harder.

The legal backdrop in most of the US is the Revised Uniform Fiduciary Access to Digital Assets Act, usually shortened to RUFADAA. The Uniform Law Commission published it in 2015 as a model law (the ULC's page for the act has the text). Most states have since passed their own version. By 2020, when Pennsylvania signed on, a Pennsylvania law firm's summary described it as enacted in almost every state.

The model act sets up a pecking order, and it changes what you should do first:

1. The company's own tool comes first. Under Section 4 of the model act, if your parent uses an online tool such as a legacy contact setting (one they can change at any time), that choice overrides a contrary instruction in a will, trust or power of attorney.
2. Then the estate documents. If there's no online tool, a will, trust or power of attorney can allow or forbid access.
3. Then the terms of service your parent clicked "agree" on years ago.

Two more details from the act matter for families. The content of email and messages gets extra protection: an executor generally gets it only if your parent consented or a court orders it, while a "catalogue" (who wrote to whom and when) is easier to get. And an agent under a power of attorney can see email content only if the POA expressly grants authority over electronic communications.

Even with permission, expect paperwork. For a deceased user's email, the model act lets the company ask for a death certificate, proof the executor was appointed, the will or record showing consent (unless your parent used the online tool), and sometimes a court finding. The company then decides whether to open the account or just hand over a copy, and it may charge a reasonable fee.

States didn't all adopt identical versions. Pennsylvania, for example, added a rule that an agent may access a principal's electronic communications and digital assets only if the power of attorney expressly says so, and that rule applies to POAs signed on or after January 19, 2021. Older POAs may be silent on all of this, which is a question for an estate attorney in your parent's state the next time any document is updated.

The phone passcode is the master key

If you do only one thing, find out how your parent's phone is opened, and who besides them could do it.

The phone is where the two-step verification codes arrive. Nearly every bank, pharmacy portal and email account now texts a code to that phone, or pops up an approval prompt on it, when someone signs in. Without the phone, even the correct password often leads to a dead end.

It's also nearly impossible to get into after the fact. Apple says plainly that devices locked with a passcode are protected by passcode encryption, and Apple can't remove the passcode lock without erasing the device. Erasing it wipes whatever wasn't backed up.

What to settle with your parent:

• Who knows the passcode. Ideally one or two trusted people. It's fine to keep it the way they keep the house key: memorized by them, and written in one secure place someone else can reach.
• Whether the phone is backed up, to iCloud or Google, and roughly how full the backup storage is. A phone that hasn't backed up since last spring holds the only copy of everything since.
• The phone carrier and account holder. If the line is canceled too soon after a death, any codes still sent to that number go nowhere. Ask the carrier about keeping the line, or moving it into a family member's name, until the main accounts are closed or switched over.
• Where the charger lives. Mundane, and the first thing anyone needs at the hospital.

While you're talking about the phone, it's a natural moment to set a family safe word too, since the phone is also where scam calls land.

Apple: Legacy Contact and Recovery Contact

Apple offers two settings that sound alike and do different jobs. Most parents need both.

Legacy Contact (after death)

A Legacy Contact is someone your parent chooses to get access to the data in their Apple Account after they die. Apple's page on how to add a Legacy Contact lists what that can include: photos, messages, notes, files and device backups. On an iPhone it's under Settings, then your parent's name, then Sign-In & Security, then Legacy Contact. The contact doesn't need an Apple device.

What families tend to miss:

• The access key is everything. To request access, the Legacy Contact needs the access key created during setup and the death certificate. Apple can't replace a lost access key. Your parent can send it by iMessage or print it. Print a copy for the estate file either way.
• It doesn't include passwords. Apple excludes data in iCloud Keychain, meaning saved passwords, passkeys and payment information, plus purchased movies, music, books and subscriptions. A Legacy Contact gets the photos, not the bank logins.
• Access is temporary. The Legacy Contact account lasts three years from when Apple approves the first request, then it's permanently deleted. Download what you want to keep.
• Any Legacy Contact can delete everything. If your parent names several people, any one of them can make decisions about the data, including permanent deletion. Pick people who will cooperate.
• It frees up the devices too, sort of. After approval, Apple removes Activation Lock from devices on that account, but they still have to be erased before anyone else can use them.

Recovery Contact (while they're alive)

A recovery contact helps your parent back into their own account if they forget the Apple Account password or device passcode. The contact gets no access to the account; they can only generate a code for your parent. Your parent can name up to five, and each one needs an Apple device with iMessage turned on. For a parent who forgets passwords, this is the setting that prevents a weekend-long lockout.

Google: Inactive Account Manager

Google's version works on a timer, not a death certificate. Inactive Account Manager lets your parent pick up to 10 people to be notified, or to receive some or all of their data, once the account has been inactive for a length of time they choose. Each person can get different data. When the time comes, contacts get an email with your parent's message and, if data was shared with them, a link to download it. They get a copy of the data, not the account itself.

Google judges activity by signals such as recent sign-ins, Gmail use including the Gmail app on a phone, and Android check-ins. That means a parent's Android phone left switched on and signed in after a death may keep the account looking active, so the waiting period may not run out when you expect. Good to know before anyone "keeps the phone going for now."

Google uses the phone number your parent enters for each trusted contact to verify that person before they can download anything, so make sure it's a number you'll still have.

If nothing is set up, Google may delete an account after at least two years of inactivity across Google. For a death without a plan, Google has a deceased user request form, but it says it cannot provide passwords or login details, and that it "may" provide content in certain circumstances after review. Closing the account first means Google can't turn over the contents later, so request data before closure.

Microsoft, and accounts with no legacy tool

Some services offer no designated-contact setting at all. Microsoft is the one most likely to matter for a parent with an Outlook.com, Hotmail or MSN email address or files on OneDrive.

According to Microsoft's page on accessing accounts when someone has died, when nobody has access, Outlook.com and OneDrive accounts are frozen after one year, and email and files are deleted shortly after. Microsoft accounts expire after two years of inactivity. Microsoft will consider releasing content only when formally served with a subpoena or court order, and even then doesn't guarantee it.

For accounts like these, the plan is less elegant: make sure the login lives in the password manager that someone can reach, and copy anything irreplaceable (scanned family documents, old photos in OneDrive) somewhere a family member can open. Social media accounts vary by platform too; some have memorial or legacy settings and some don't. Note which ones your parent has and what they'd want done with each: kept, memorialized if offered, or closed.

Password managers and emergency access

A notebook of passwords is better than nothing, and many parents keep one. But it goes stale fast, and anyone who opens the drawer can read it. A password manager with an emergency access feature is the better setup, especially for the long-distance child.

Three common options, as of their current help pages:

Bitwarden's emergency access page explains the two levels: View gives read access to the vault, while Takeover lets the contact set a new master password, which replaces the old one and removes your parent's two-step login methods. For a living parent who just needs help, View is usually the gentler choice.

1Password's Emergency Kit page actually recommends writing the account password on at least one printed copy. That's the one place a written password makes sense: a single sheet, kept in a safe or a bank box, that opens a vault holding everything else. It does not belong in the everyday binder on the kitchen shelf.

Apple's Passwords sharing is handy for the few logins you help with today, like the pharmacy portal. A Legacy Contact won't see the rest of the Keychain later.

Photos: the part everyone actually cares about

Ask families what they wish they'd saved, and the answer is rarely a bank login. It's the pictures. A few things make photos easier to keep:

• Find out where they live. iCloud Photos, Google Photos, a phone that's never been backed up, a computer in the den, a shoebox of prints. Often it's all five.
• Turn on the legacy setting for that account. Apple's Legacy Contact covers iCloud photos. Google's Inactive Account Manager lets your parent choose which kinds of data each person gets, so the photos can go to someone who never sees the email.
• Copy the important ones now. A shared family album or a copy on someone else's drive costs an afternoon and survives any account problem.
• Ask who's in them. No tech setting does this part. Sit with your parent and a stack of old photos, and write names on the backs or in the captions. Twenty years from now, that's what the grandchildren will want.

Subscriptions, autopays and the money you can't see

Then there are the charges that renew on their own: streaming, cloud storage, apps, a newspaper, a monthly box of something. After a death or a move to care, they keep billing until someone stops them.

Make a short list of every recurring charge, which card or account pays it and where it was bought (direct from the company, or through the App Store or Google Play). Purchases through Apple are canceled in the Apple Account settings, which Apple explains on its page for canceling a subscription from Apple. Others have to be canceled with each company. AARP's guide to managing unwanted subscriptions has tips for getting out of the stubborn ones. Our guide to organizing important documents for aging parents has the wider list of bills and accounts to track.

Also look for money held online: PayPal or Venmo balances, airline miles, gift card balances in an app, and any cryptocurrency.

Crypto, briefly

If your parent owns cryptocurrency, find out whether it's held by an exchange (a company account, which can usually be dealt with like any other financial account) or in a wallet they control. For a self-held wallet, the SEC's crypto custody bulletin doesn't soften it: if the private key is lost, access to the assets is permanently lost. The seed phrase that restores a wallet should be stored securely and not shared. For estate purposes that means: record that the wallet exists and where the recovery phrase is stored, and have an attorney advise on how to pass it on.

The digital asset inventory: what to write and what not to

This is the page for the binder. It records where things are and who has access, so it isn't a security problem sitting on a shelf.

Keep the Emergency Kit sheet, any printed access keys and the passcode in the same secure spot as the original legal papers. Our guide to where to keep important documents compares the home safe and bank box options. If you live far away, add the digital page to the set of things a local helper can reach, as in our long-distance caregiving checklist.

Bringing it up with your parent

Many parents find this easier to discuss than money. A few openers:

• "If your phone died tomorrow, how would you get back into your email?"
• "Can I set it up so I could help you if you got locked out?"
• "Which photos would you want the grandkids to have?"

Then do the settings together, on their phone, in their hands. Several tools need the account owner to confirm, and doing it together keeps your parent in charge. For more openers on the bigger topics, see our list of questions to ask aging parents.

Frequently asked questions

What is digital estate planning?

Planning for what happens to someone's online accounts, devices and files if they die or can't manage them: an account inventory, the companies' legacy settings, password manager emergency access, and digital asset language in the POA and will.

Can I use my parent's password after they die?

Having the password and being authorized to use it aren't the same thing. The model RUFADAA says a fiduciary's authority can't be used to impersonate the user, and each company's terms apply. Ask the estate attorney before signing in as your parent, and use the company's official process for closing accounts.

Does a power of attorney give access to email?

Not automatically. Under the model act, an agent gets the content of email and messages only if the POA expressly grants that authority, and state versions differ. Ask an attorney whether your parent's POA includes it.

What happens to iCloud photos when someone dies?

If your parent named a Legacy Contact, that person can request access with the access key and a death certificate, then download photos within three years. Without one, Apple's deceased-account page says that in the US you'll generally need a court order, naming you as the legal personal representative, agent or heir and directing Apple to help.

Should passwords go in the emergency binder?

No. Record where passwords are kept and who has emergency access. The one written password worth having is the master password on a password manager's emergency sheet, kept in a safe or bank box.

Getting it on paper

You don't need special software for any of this: your parent's phone, an hour together and the tables in this article will cover it, and each setting takes minutes. Writing it down somewhere findable is the step that tends to slide.

For that part, Emergency Binder Now can help: about 25 minutes of guided questions turns into a printable binder for your parent, with a phone and digital life page that notes where passwords are kept (never the passwords), plus the one-page emergency sheet, where each legal document lives and a list of gaps to close. You can see a sample binder before deciding.

This article is general information, not legal or financial advice. Laws on fiduciary access to digital assets differ by state, and company policies change; check current help pages and talk with an estate attorney in your parent's state.