Account recovery is designed for a living account holder. A digital-legacy plan answers a different question: what should happen to important data if you die or can no longer manage the account?
There is no universal “digital executor” button. Apple, Google, and Facebook make different promises, trigger access in different ways, and exclude different information. Set each one deliberately.
First decide the outcome for each account
Make a short inventory of accounts that hold information another person may need: email, cloud files, photographs, a public profile, subscriptions, and any account that controls recovery for the others.
For each, choose an intended outcome:
Transfer selected data to a trusted person.
Preserve or memorialize a public profile.
Delete the account and its stored data.
Leave untouched information that no one needs.
Do not assume that “access” includes everything. Purchased media, passwords, encrypted stores, private messages, and business-workspace records can follow separate rules.
Apple: the access key is part of the plan
Apple Legacy Contact lets you choose one or more people to request access to certain Apple Account data after your death. Apple says the accessible data can include photos, messages, notes, files, and device backups.
Apple excludes purchased movies, music, books, and subscriptions, along with information stored in iCloud Keychain such as payment information, passwords, and passkeys.
The contact needs the access key generated during setup and documentation of the death. Apple describes a death certificate as the usual document while noting that requirements vary by country or region. A contact does not need an Apple Account or Apple device when you appoint them.
After adding a contact:
Confirm that they received the access key.
Keep another copy with the records they would reasonably check.
Explain what you want done with the data.
Revoke and replace the contact if the relationship changes.
Apple says any one of multiple legacy contacts can make decisions about the account data, including permanent deletion. Do not add several contacts on the assumption that they must act together.
Google: inactivity is the trigger
Google's Inactive Account Manager can notify selected people or share selected account data after Google determines that the account has been inactive for the period you choose.
Google says it considers signals such as sign-ins, My Activity, Gmail use, and Android check-ins. You can select up to ten people, choose which data types each receives, and decide whether the account should be deleted. Contacts are notified only when the plan triggers, not when you configure it.
That means a good setup includes:
a current phone number for each trusted contact;
a message that explains why they are receiving the notice;
only the data categories they need; and
a waiting period that fits how often you normally use the account.
Google also says it may delete an account after at least two years of inactivity when no plan preserves it. Its deceased-user request guidance says it may work with immediate family or representatives in some circumstances, but will not provide passwords or login details. A request after the fact is not a substitute for setting the available controls now.
Facebook: management is limited after memorialization
Facebook's legacy-contact documentation lets an eligible user choose a contact to manage a memorialized profile or select deletion after death.
Facebook says a legacy contact can write a pinned post, respond to new friend requests, update the profile and cover image, and—if the setting was enabled—download a copy of shared content. The contact cannot log into the account, read messages, edit old posts, or remove friends.
Those limits are material. Choosing a Facebook legacy contact is a plan for the profile after memorialization, not a grant of full account access.
Keep secrets and instructions separate
A platform's legacy process should not require giving someone your everyday password while you are alive. Sharing a live password can expose messages, saved payment methods, recovery settings, and other linked accounts immediately.
Keep the plan in two layers:
An account inventory and your intended outcome, stored with records the responsible person can find.
The provider's required artifact, such as Apple's access key or the contact details inside Google's plan.
If you use a password manager's emergency-access or inheritance feature, verify its current rules separately. Do not claim that an Apple, Google, or Facebook legacy designation controls the password manager too.
Review the plan once a year
Check whether the trusted person is still appropriate, their contact information works, and the accounts still hold what your instructions describe. Also review the plan after a separation, death, move between countries, or change in the main email account.
Test ordinary account recovery while you are alive, but do not trigger or simulate a death request. The practical check is whether the designated person knows the plan exists and can find the provider-specific information without gaining premature access to the account.
Use the password security guide for present-day recovery codes and sign-in protection. Digital legacy and routine account recovery need separate records because they solve separate events.