The Right to Be Forgotten: Digital Legacy and Death

When Marcus died unexpectedly at 38, his sister began the painful process of settling his digital estate. While going through his files, she found a document labeled “If I Die – Digital Wishes.” Among his instructions was one that surprised her: “Please delete everything. I don’t want my life searchable on the internet forever. I want to be forgotten digitally, remembered only in the hearts of those who knew me.”

Marcus’s wish reflects a growing tension in the digital age: While some people want their digital presence preserved as legacy, others want the opposite—digital erasure, privacy even in death, the right to fade from the internet as they fade from living memory.

Also known as the right to erasure, the GDPR gives individuals the right to ask organizations to delete their personal data. But this right, codified for living people in Europe’s General Data Protection Regulation (GDPR) and similar laws worldwide, becomes complicated—sometimes impossible—after death.

Data protection laws, such as the EU’s GDPR do not apply to data of the deceased or do not explicitly address its applicability to those who passed away. This gap leaves families navigating murky legal territory: Can they request deletion of a deceased loved one’s data? Must platforms comply? What if the deceased wanted to be forgotten, but family members want to preserve their digital presence?

This guide explores the right to be forgotten after death—its legal foundations, practical limitations, ethical dilemmas, and how families can honor a deceased person’s wishes for digital erasure in a world designed for permanent digital memory.

Understanding the Right to Be Forgotten

For the Living: GDPR Article 17

The right to be forgotten was replaced by a more limited right of erasure in Article 17 of the GDPR, which came into force in May 2018.

GDPR Article 17: Right to Erasure

Living individuals can request data deletion when: 1. Personal data is no longer necessary for the purpose it was collected 2. They withdraw consent for data processing 3. They object to processing and there are no overriding legitimate grounds 4. Personal data was unlawfully processed 5. Data must be erased to comply with legal obligations 6. Data was collected from a child without proper consent

Limitations:

Organizations can refuse deletion when data is needed for: – Exercising freedom of expression and information – Compliance with legal obligations – Public interest in public health – Archiving purposes in the public interest – Establishing, exercising, or defending legal claims

The Death Gap: Limited Legal Protection

Current privacy regimes such as the GDPR, CCPA, and LGPD afford comprehensive data rights to living individuals, but these protections rarely extend to deceased users.

Why Privacy Laws Don’t Cover the Dead:

Philosophical Foundation: Privacy laws aim to protect autonomous decision-making by living individuals about their information. Death ends personhood in legal sense, so protections designed for living persons don’t automatically apply.

Practical Considerations: – Dead people can’t exercise their own rights – Survivors may have legitimate interests in the data – Historical and genealogical value emerges over time – Public interest sometimes outweighs privacy

Legal Reality: In most jurisdictions, data ceases to be “personal data” under privacy laws once the person dies, removing statutory deletion obligations.

Country-by-Country Approaches (2026)

Since the EU’s GDPR does not apply to the data of decedents, member states develop their own legal frameworks to protect the data and privacy of the deceased.

European Union Member States

France: Digital Republic Act (Article 63)

According to Article 63 of the Digital Republic Act, people have a right to set instructions on the preservation, deletion, and disclosure of their personal data after death.

Key Provisions: – Individuals can issue directives during lifetime about posthumous data handling – Instructions can be general (apply to all data) or specific (particular platforms/data types) – Can designate trusted person to execute these wishes – Platforms must comply with pre-death instructions – Heirs have limited rights to access/delete data even without instructions

Italy: Legislative Decree 101/2018

Legislative Decree 101/2018 provided the extension of the rules set out in the GDPR also to the treatment of personal data of deceased people, stating that “the rights relating to the personal data of deceased people may be exercised by those who have their own interest, or act to protect the deceased as an agent or for family reasons deserving of protection”.

Key Provisions: – GDPR rights extend to deceased persons’ data – Can be exercised by those with legitimate interest – Family members can act to protect deceased’s memory – Balances deceased’s wishes with family rights – Courts decide disputes

Spain – Article 3 of Data Protection Law explicitly extends rights to deceased persons – Heirs or designated persons can exercise deletion rights – Unless deceased explicitly prohibited such actions

Germany – Post-mortem personality rights under civil law – Protection of dignity extends beyond death – Federal Court rulings support heirs’ access and deletion rights – Strong protection against commercial exploitation of deceased’s image/data

United Kingdom (post-Brexit) – UK GDPR does not explicitly cover deceased persons – Data Protection Act 2018 gives limited protection – Common law personality rights may apply – Largely dependent on platform policies

United States

California (CCPA/CPRA) – California Consumer Privacy Act primarily applies to living residents – Does not explicitly extend rights to deceased persons – Platforms may have own policies about deceased users – Estate executors may have contractual rights

Other States – No comprehensive federal law – State-by-state patchwork – Digital asset laws (RUFADAA) focus on access, not deletion – Generally rely on platform terms of service

Other Jurisdictions

Canada – PIPEDA (privacy law) doesn’t explicitly cover deceased – Some provincial laws provide limited protection – Generally follows platform policies

Australia – Privacy Act 1988 doesn’t cover deceased individuals – Relies on platform policies and contractual rights

Rest of World – Most countries lack specific posthumous digital rights – Varies widely by jurisdiction – Often defaulting to platform policies

Platform Policies: The Real Rules (2026)

Given limited legal requirements, platforms set their own policies about deceased users—and these vary dramatically.

Facebook/Meta

Current Policy: – Accounts can be memorialized or deleted – Only close family (spouse, parent, child, sibling) or executor can request deletion – Requires death certificate and proof of relationship – Memorialized accounts remain visible but clearly marked – Deletion is permanent and irreversible – No access to account contents provided

Right to Erasure: – Will delete account at family request – Does not require deceased person’s pre-death instructions – Family’s wishes generally respected – Process takes several weeks

Google/Gmail

Inactive Account Manager: – Users can set what happens after prolonged inactivity – Options include deletion after period of inactivity (3, 6, 12, 18 months) – Can designate trusted contacts to notify – Delete all data or selective deletion – Must be set up before death

Post-Death Requests: – Family can request account closure – Requires death certificate and legal documentation – Does not provide account access – Will delete if authorized representative requests – Process can take months

Apple/iCloud

Digital Legacy Program: – Users can designate “Legacy Contacts” before death – Legacy Contacts can access limited data (not email/messages) – Account closure requires death certificate – Will delete account at authorized request – No automatic deletion option

Deletion Process: – Requires extensive documentation – Takes significant time – Does not honor pre-death deletion requests unless through Legacy Contact

Twitter/X

Policy (as of 2026): – Inactive accounts deactivated after 6 months of inactivity – Permanent deletion after 30 days of deactivation – Family can request immediate deletion – No memorialization option – No access provided to family

Deletion Timelines: – Effectively automatic for inactive accounts – Faster deletion if family requests

Instagram

Similar to Facebook: – Can be memorialized or deleted – Family request honored with documentation – No automatic deletion option during lifetime – Account content not provided to family

Automatic Deletion: – Removes profile when notified of death – No memorialization option – Requires death certificate or obituary – Family can request expedited deletion

Right to Erasure: – Relatively easy to have account deleted – Professional network not treated as memorial space

TikTok, Snapchat, and Emerging Platforms

Varying Policies: – Often underdeveloped death policies – May rely on inactivity-based deletion – Limited options for family requests – Policies evolving as platforms mature

Practical Challenges in Exercising Right to Be Forgotten

Challenge 1: Discovery (Finding All Accounts)

The Problem: To delete accounts, you first need to know they exist. Most people have 80-100 online accounts they’ve forgotten about.

Solutions: – Password managers (if deceased used one) – Email search for “welcome” “account created” “verify email” – Bank/credit card statements for subscription charges – Browser saved passwords – Digital estate inventory (if deceased created one) – Specialized services that find orphaned accounts

Challenge 2: Authentication (Proving Authority)

Requirements Vary: – Death certificate (always) – Proof of relationship (marriage certificate, birth certificate) – Letters testamentary or similar executor documentation – Government-issued ID of requestor – Notarized affidavits – Court orders (sometimes)

Difficulty: – Different platforms require different proof – International platforms may not accept local documents – Translation requirements for non-English documents – Processing time varies (weeks to months)

Challenge 3: Legal Limitations

When Deletion Can’t Happen:

Legal Holds: – Accounts involved in ongoing legal matters – Criminal investigations – Civil litigation – Tax audits

Conflicting Rights: – Other family members want preservation – Business accounts with continuing obligations – Joint accounts or shared content – Content involving other living people

Practical Impossibility: – Content already scraped and redistributed – Cached versions on archive sites – Screenshots and downloads by others – News articles quoting social media – Academic or research databases

Challenge 4: The Streisand Effect

The Paradox: Attempting to remove content can draw MORE attention to it, especially: – Public figures – Controversial content – News-worthy information – Content already widely shared

Risk Assessment: – Will deletion attempts backfire? – Is quiet lapse into obscurity better than active removal? – How public is the content currently?

Challenge 5: Technical Realities

Permanent Deletion Myth:

Backup Systems: – Platforms maintain backups for extended periods – “Deleted” data may persist in backups for months/years – Full technical deletion often impossible

Web Archives: – Internet Archive (Wayback Machine) – Archive.is – Google Cache – Other archival services – May refuse deletion requests (archival mission vs. privacy)

Third-Party Copies: – Other users’ downloads and screenshots – Embedded content on other websites – Quotes and reposts – Data broker aggregation

Ethical Tensions: Competing Interests

The Deceased’s Wishes vs. Family’s Needs

Scenario: Deceased explicitly wanted all digital presence deleted, but grieving spouse finds comfort in accessing social media posts and photos.

Competing Values: – Autonomy of deceased (their wishes should be respected) – Wellbeing of survivors (they need comfort during grief) – Practical memory-keeping (content has sentimental value)

Resolution Approaches: – Time-delayed deletion (preserve for grief period, then delete) – Private archival before public deletion (family keeps copy) – Partial preservation (photos yes, posts no) – Therapeutic consideration (is preservation helping or hindering grief?)

Privacy vs. Historical Value

Scenario: Deceased was involved in historically significant events. Their digital footprint has research value.

Competing Values: – Right to be forgotten (privacy extends beyond death) – Public interest (historical record matters) – Academic freedom (research value) – Family’s wishes (next of kin want privacy)

Resolution Approaches: – Delayed release (sealed for X years, then accessible) – Redaction of sensitive personal information – Institutional archiving with access restrictions – Balancing tests (proportionality of privacy intrusion vs. public value)

Individual Accounts vs. Shared Content

Scenario: Account contains photos and posts featuring other living people who didn’t consent to deletion.

Competing Values: – Deceased’s right to erasure (they wanted it deleted) – Others’ rights to their own images and memories – Shared experiences documented jointly – Collaborative creative work

Resolution Approaches: – Selective deletion (remove deceased’s solo content, preserve shared) – Content transfer to others featured – Redaction of deceased from shared content – Negotiation among stakeholders

Freedom of Expression vs. Erasure

Scenario: Deceased made public statements on matters of public interest. Media/researchers want access.

Competing Values: – Right to be forgotten – Freedom of expression and press – Public’s right to information – Historical record preservation

Legal Framework: Even in GDPR for living people, freedom of expression can override erasure rights. Courts balance: – Nature of information (private vs. public concern) – Method of publication (private vs. intentionally public) – Time elapsed (recent vs. historical) – Ongoing relevance

Taking Action: How to Honor Right-to-Be-Forgotten Wishes

If Your Loved One Left Instructions

France-Style Directives: If deceased left written instructions about digital deletion:

Locate Documentation – Will, estate documents – Digital asset inventory – Separate “digital will” or directives – Password manager notes – Letters of instruction
Verify Authenticity – Confirm it’s legitimately from deceased – Check date (recent vs. outdated) – Ensure it’s their actual wishes (not coerced)
Assess Scope – General deletion (everything) vs. specific (certain platforms) – Immediate vs. time-delayed – Complete vs. partial (save some, delete others) – Exceptions specified?
Execute Systematically – Create spreadsheet of all accounts – Research deletion process for each platform – Gather required documentation – Submit requests – Track status – Follow up on delays
Document Everything – Keep records of requests sent – Screenshot proof of deletion – Save correspondence with platforms – Note what could/couldn’t be deleted – Explain in estate records

If No Instructions But You Believe They’d Want Deletion

Making the Decision:

Consider: – What did they value? (Privacy-oriented? Public presence?) – Past statements about digital privacy – General personality and values – How they used social media (private vs. public) – Their concerns about reputation or legacy

Consult: – Other family members – Close friends who knew them well – Their attorney or executor – Therapist or grief counselor

Legal Positioning: – As executor, you have authority (in most jurisdictions) – Absent specific instructions, you make reasonable choices – Document your reasoning – Be prepared to defend decision if challenged

Platform-by-Platform Action Plan

Priority Order:

High Priority (Delete First): 1. Financial accounts with personal data 2. Medical/health platforms 3. Dating apps or adult content sites 4. Private messaging platforms 5. Email accounts (after saving important correspondence)

Medium Priority: 1. Social media (Facebook, Twitter, Instagram) 2. Professional networks (LinkedIn) 3. Forums and community sites 4. Shopping accounts with saved data 5. Entertainment subscriptions

Lower Priority (or Consider Preservation): 1. Photo storage (Google Photos, iCloud) – save first 2. Creative platforms (YouTube, blogs) if content has value 3. Gaming accounts (may have community value) 4. Memorial or genealogy sites

Deletion Process Template:

For each platform: 1. Visit help/support center 2. Search “deceased user” or “memorialize account” 3. Locate deletion request form 4. Gather required documents 5. Submit request 6. Note submission date 7. Follow up after 2 weeks if no response 8. Escalate if necessary 9. Document outcome

Creating Paper Trail

Why Documentation Matters: – Proves you honored their wishes – Protects against claims you mishandled estate – Provides record for other family members – Shows due diligence to courts if necessary

What to Document: – Original deletion directives from deceased – List of accounts and deletion status – Copies of deletion requests sent – Platform responses – Screenshots of deleted accounts – Challenges encountered – Final status report

Store: – With estate paperwork – Digital copy in secure location – Provide copy to attorney – Share summary with family if appropriate

When Deletion Isn’t Possible: Managing Legacy Instead

Sometimes complete erasure isn’t achievable. Alternative approaches:

Privacy Through Obscurity

Let Accounts Go Dormant: – Stop engaging with content – Let it sink in search rankings – Natural fade from relevance over time – Often more effective than fighting deletion battles

Minimal Digital Footprint Management

Reduce Without Erasing: – Delete most content, leave minimal profile – Remove identifiable photos – Scrub personal details – Make accounts private – Limit searchability

Digital Obituary Redirect

Acknowledge Death While Minimizing Detail: – Replace full profiles with simple memorial notice – “In memory of [Name], [dates]” – Redirect to offline memorial or charity – Prevents account appearing active – Doesn’t preserve detailed personal content

Strategic Partial Deletion

Keep What Matters, Remove What Doesn’t: – Delete personal details, keep creative work – Remove private content, keep public professional contributions – Archive photos privately, delete public presence – Preserve significant content, erase mundane

For Yourself: Pre-Planning Digital Erasure

Don’t Leave This Decision to Grieving Family:

Create Digital Erasure Directives

Template: Right to Be Forgotten Instructions

“Upon my death, I request the following actions regarding my digital presence:

General Directive: [ ] Delete all digital accounts and data [ ] Preserve all digital accounts and data [ ] Selective preservation (see below)

Specific Instructions:

Social Media: – Facebook: [Delete / Memorialize / Archive then delete] – Instagram: [Delete / Memorialize / Archive then delete] – Twitter: [Delete / Let lapse / Preserve] – LinkedIn: [Delete immediately / Preserve] – [Other platforms]: [Instructions]

Email Accounts: – [Email address]: [Delete after X months / Save specific folders then delete / Delete immediately]

Photos and Media: – Google Photos: [Download for family, then delete account / Delete all / Preserve] – iCloud: [Save to family, delete account / Delete all / Preserve]

Other Accounts: – [Account type]: [Specific instructions]

Exceptions: [Any content you specifically want preserved despite general deletion preference]

Designated Agent: I authorize [Name], [relationship] to execute these wishes. Alternate: [Name].

Timing: [Immediate deletion / After X months to allow family access / Specific timeline]

Signed: ___ Date: _____”

Choose Deletion-Friendly Platforms

When Setting Up New Accounts: – Research platform’s deletion policies – Prefer platforms with clear posthumous deletion paths – Avoid platforms with permanent content policies – Use privacy-focused alternatives when possible

Use Built-In Deletion Tools

While Alive: – Google Inactive Account Manager (set to auto-delete after inactivity) – Facebook Legacy Contact with deletion authorization – Apple Legacy Contact – Password manager emergency access with deletion instructions

Minimize Digital Footprint Proactively

Privacy Practices: – Don’t overshare publicly – Use pseudonyms where appropriate – Regularly delete old content – Limit personal information shared – Use privacy settings restrictively

Regular Digital Cleanups: – Annual account audit – Delete unused accounts – Clear old posts and photos – Update privacy settings – Reduce data footprint continually

The Philosophical Question: Should We Be Forgotten?

Arguments For Right to Be Forgotten After Death

Personal Autonomy: Your wishes about your data should extend beyond your death. Consent shouldn’t expire with life.

Dignity and Respect: Allowing digital presence to be commodified, mined, or manipulated after death violates human dignity.

Family Wellbeing: Some families need closure. Perpetual digital presence can complicate grief and healing.

Preventing Harm: Privacy regulations generally do not apply to deceased users, thus their digital data often remains accessible, risking privacy violations, unauthorized use, and even non-consented digital cloning that may cause harm to their legacy and memory, and harm their surviving family and friends.

Arguments Against Right to Be Forgotten After Death

Historical Value: Every life is part of historical record. Future generations benefit from access to past lives, including ordinary people, not just famous figures.

Genealogical Importance: Descendants want to know ancestors. Digital erasure cuts family tree branches.

Public Interest: Some lives, actions, and statements have ongoing public relevance. Society’s interest may outweigh individual privacy.

Freedom of Information: Censoring the past is dangerous. Once public information should remain public for research, journalism, and democratic function.

Survivors’ Rights: Family members have their own relationship with deceased’s memory. Their needs matter too.

Conclusion: Balancing Memory and Erasure

The right to be forgotten after death exists in a liminal space—honored in some jurisdictions, ignored in others; respected by some platforms, complicated by others; desired by some deceased, devastating to some survivors.

Key challenges include fragmented regulations, advanced deletion methods like machine unlearning, and developing ethical guidelines for digital legacies.

There’s no single right answer. Some people’s legacies should live on digitally, shared across generations, contributing to collective memory. Others deserve the privacy they sought in life, the gradual fade into obscurity that death once naturally provided.

If you want digital erasure after death, document it clearly, designate someone to execute it, and use platforms that respect these wishes. If you’re honoring a loved one’s right-to-be-forgotten wishes, know it will be hard, incomplete, and sometimes impossible—but the effort itself is an act of love and respect.

And if you’re creating policies, building platforms, or crafting laws: remember that privacy, dignity, and autonomy don’t end with a heartbeat. The dead deserve protection too—even if (especially if) they wanted to be forgotten.

Resources

Legal Information: – GDPR Article 17: Right to Erasure – GDPR.eu: Right to be Forgotten Explained – Deceased Data Rights Explained

Platform Deletion Guides: – Facebook: Memorialization and Deletion Requests – Google: Inactive Account Manager – Apple: Digital Legacy Program

International Frameworks: – Digital Legacies in 2025: International Overview – Beyond the Grave: Post-Mortem Data Privacy