What Happens to your Online Account When?

Return to the list of client alerts

Whether the accounts belong to you personally or you are the manager of a company owned account, if you pass away or leave the company, a succession plan needs to come into play.

For personal accounts, some services provide a mechanism to either delete an account or in some cases like Facebook, memorialize an account.  Faceback for example, has a page that allows someone to request that an account be deleted or what Facebook calls “memorialized”, meaning the account stays there as a memorial but no one can log into it.  I did not find an option for Facebook that allows you to take over the account.  If your Facebook account owner designated a legacy person, then that person can make the request, otherwise you have to provide a death certificate to Facebook (what could go wrong here).  How, exactly, Facebook is going to know whether the John Smith page that you asked to be removed is the right John Smith or whether you even have the right to ask is not at all clear to me and I suspect a judgement item.  Suffice it to say, given the number of online accounts that the average person has and the fact that the process is different for each service, this can get pretty burdensome very quickly.

For businesses, if a person who manages an account leaves the company, especially on unfriendly terms, the company can actually get completely and totally locked out of the account.  If it is an important account, that could be a problem.  Many times a company account is not set up in the first place as being owned by the company in the eyes of the provider.  I have heard of cases where the company was not able to regain control of a social media account because the provider says that it belongs to the person who left and not the company.  You can sue the social media company to regain control and 5 years and thousands of dollars later, you may or may not get control of it.

Some companies such as eBay will lock the account if they found out that a person passed away – every company is different.

So what should you do, whether you are a business or an individual?

The recommendations are slightly different between personal and business, but close enough that I will only create one list.

For business accounts, make sure from a policy and procedure standpoint that the company both legally and in the eye of the service provider owns the account.  If you legally own the account but the service provider doesn’t agree with you, you may be able to regain control, but it may take a while.  A looooooong while.

For all accounts, if there is a desire to retain control in case of unexpected events, either create multiple userids for the account if the service allows that or else make sure that more than one person knows the password.  If creating more than one account, make sure that all of the accounts have the appropriate administrative permissions.

Remember that, in the case of a business, if the person leaves under less than friendly circumstances, that person could, possibly, delete the other accounts.  In that case, being able to prove ownership may be your only recourse.

For both businesses and individuals, one option is to use a password manager.  This is a way to share passwords securely among a married couple or the appropriate people in an IT department.  For businesses, more sophisticated managers allow you to share passwords among groups of people.  Certainly for a husband and wife, that is a good solution.

A less technical solution is to create a password book and place it in a safe place like a bank safe deposit box or home safe, but if that list is not updated, it loses its value.  A password manager is likely easier to keep up to date.

For some services, your license for whatever you bought (a song on iTunes or a game on Steam) only lasts as long as you do, so IF they find out that you have moved on, your licenses will be revoked.  This is likely not a problem for you because you are no longer here, but if you share an account, say, with a spouse, that could be a problem.  In that case, you do not want the service provider to know that you are gone.

I think at this point you can understand that, whether you are a business or an individual, some planning is in order.


Privacy, Security and Cyber Risk Mitigation in the Digital Age

Visit Us On FacebookCheck Our Feed