What Happens to Your AI Chats When You Die?

Think about what you have actually typed into a chatbot over the last year. Let’s set aside the recipes and the code. The other things. The symptom you described to it before you were willing to describe it to a doctor, or instead of a doctor. The message you drafted three times because you were afraid to send it. The marriage you talked through at two in the morning. The worry about money, the question about a parent, and the sentence you have never said out loud because saying it out loud would make it real and typing it to a machine felt safe because the machine was not a person and was never going to repeat it at dinner.

That record exists. It sits in an account on a server owned by a company. And most people have never once thought of it as a thing that will outlive them.

It will. What happens to it when you die is the question this piece is about, and the answer is stranger and more uncomfortable than the one you would guess, because the systems we built for inheritance, for privacy, and for grief were all designed for a world that did not contain this kind of record.

There is a wave of writing right now about the dead coming back as chatbots. The grief-tech industry, the deadbots and griefbots trained on a person’s messages so the living can keep talking to them, the ethicists warning about digital hauntings. All of that is about a manufactured thing, a new artifact built after death to imitate someone who is gone.

This piece is about the plainer thing that already exists: the real conversations, the ones you had yourself while you were alive, sitting in your account exactly as you left them. The original transcript of how you actually think when you believe no one is watching. That record is more revealing than any griefbot, and almost no one is asking what becomes of it.

A diary is written with a reader in mind, even if the reader is only your future self. You choose what to put in it. People do not write to a chatbot that way. They write the way they search, in fragments, unguarded, because the entire appeal of the thing is that it feels consequence-free. That is exactly what makes the archive so sensitive. It holds the health questions you were too anxious to ask anyone, the financial situation you have not told your family, the relationship doubts, the things about your own mind you were testing out in private.

And it is not even a diary, because you did not write it alone. It is a back-and-forth, your half and the model’s half, turn after turn, kept by a company that built a retention schedule, a deletion flow, and a training setting, and never wrote a single line about what happens to any of it when you die. You were co-authoring the most private record of your life with a service that planned for everything except your absence.

It is also not only about you. Read back through your own chats and count how many other people are in them. The friend whose diagnosis you described to ask what it meant or the partner named in the message you were rehearsing. The colleague, the child, the parent whose situation you typed out to think it through. Those people never agreed to be in your archive, cannot see that they are, and have no way to ask for removal. When your conversations are inherited or subpoenaed, their secrets travel with yours, and the protection this whole piece is about, the one that ends at your death, was never theirs to begin with.

I have one scope note before the mechanics. This is about your personal account. If your conversations happen in a workplace or enterprise account, or through an employer's API, the data was the company's to control from the start, with its own retention and its own rules, so it was never yours to hand on or delete. What follows is about the consumer account that you, and only you, hold.

For a growing number of people this is the most complete record of their interior life in existence, more complete than their texts, their email, or anything they have said aloud, and they are producing it daily without thinking of it as a record at all. When you die, that is the thing in question. Not your photos or your playlists, which the press has covered for years. The transcript of your unguarded thinking.

While you are alive, you have real control over these conversations; you can delete them. Every major provider lets you remove a chat or your whole account, and most promise to purge it from their systems within about thirty days. If you are in Europe, you have more: the right to erasure under the GDPR, the so-called right to be forgotten, which lets you compel a company to delete personal data it holds about you.

Here is the part that matters. Every one of those powers is yours alone, and every one of them is built around a living person who logs in and asks. OpenAI’s account deletion requires you to verify the account email or a linked phone number, and the company says plainly that if you cannot access either, you cannot complete the deletion yourself. Its right-to-be-forgotten process is written entirely for a person making a request about their own data. The GDPR is the same: its protections attach to a living data subject who exercises them.

So the single safeguard standing over this record is a switch only you can reach, and you can reach it only while you are alive. The moment you would most want it to operate, the moment you are gone and can no longer tend the account yourself, is the exact moment it stops working.

There is a second problem hiding inside the first. Deleting the conversation is not always the same as deleting what the system learned from it. These products now carry memory across chats, holding facts about you from one session to the next, and on consumer tiers your conversations may have trained the model itself. So a clean deletion of the transcript can leave the derived traces behind, the remembered details and whatever the model absorbed, in a form no heir and often no engineer can point to and remove. The archive is the visible part. What the system quietly knows about you is the part that does not show up in any account you could hand over or wipe.

And death is not even the hardest version of this. Let’s think about the incapacity. A stroke, an accident, advancing dementia, and you are alive, so no estate opens and no will takes effect, yet you can no longer log in, delete, or consent to anything. Every lock described here clamps shut with none of the after-death machinery available to release it. The instrument that helps here is a power of attorney that explicitly covers digital accounts and the content of communications, drafted while you still can, because the person who would act for you needs the same authority a fiduciary needs after death, and by default they do not have it.

US Side

You might assume your family steps in here, the way an executor sorts through a filing cabinet. There is even a law for it. Most US states, to be exact, forty-five of them, have adopted the Revised Uniform Fiduciary Access to Digital Assets Act, usually shortened to RUFADAA. It was written precisely so that the person who settles your estate can reach your digital life.

I read the actual rule and it does the opposite of what you would hope. RUFADAA draws a line between the catalogue of your communications, meaning the record that you exchanged messages, and the content of your communications, meaning what the messages said. Your executor can get the catalogue. For the content of your electronic communications, your emails, your chats, your private messages, RUFADAA gives them access only if you explicitly consented to disclosure before you died. Without that consent, the law instructs the company to withhold the contents.

That is not an accident or a gap. It is how it is designed in the first place. The drafters decided that the most private category, what your communications actually say, should stay sealed unless you opened it on purpose. So the very law meant to hand your family the keys specifically keeps this one key in your pocket, and you are no longer here to pass it on.

Underneath RUFADAA sits an older federal law that does the same work, which is the Stored Communications Act. It bars a provider from handing over the content of your communications without lawful consent or legal process. One reason RUFADAA centers on your prior consent is to supply exactly the consent that federal law demands. Without it, the company is not merely reluctant to share your chats with your grieving family. It is barred from doing so voluntarily, which leaves your family only the slower route of going to court.

There is a deeper uncertainty under all of this, and it is worth naming rather than hiding. RUFADAA and the Stored Communications Act were written for email and stored files, and they sort accounts into categories built for that era. Whether a chatbot transcript, the back-and-forth between you and a model, fits the definition of an electronic communication, or counts instead as user-generated content stored with a provider, is an open question that predates the technology and has not been settled for it. That ambiguity cuts against certainty in every direction. It means even the rules your family would try to invoke may not map cleanly onto the thing they are reaching for, so no one can yet say with full confidence which framework governs your chats at all.

EU Side

Europe arrives by a different road, and parts of it are heading the opposite way. The GDPR says in Recital 27 that it stops applying to the personal data of the dead, and it hands the question to each member state. Most have left it open, so the protection lapses and the company’s terms of service decide. A few states went further and built the opposite default.

• France, first in the European Union, lets you set directives under Article 85 of its data protection law, instructions on the retention, deletion, and communication of your data after death, lodged with a notary or a certified trusted third party. A directive aimed at a specific service has to carry your own consent, so accepting the terms of service can never stand in for it, and where you leave no directive, your heirs may exercise your data rights.

• Italy reaches a similar result through its code: in 2025 the Court of Venice ordered a technology company to preserve a deceased person’s cloud data and hand the access credentials to the heir, holding that a company’s standard terms cannot override the statutory right of post-mortem access.

So the European picture splits in two. Much of it lapses into the provider’s terms the way the United States does, while France and Italy are building the default the US withholds, the family able to reach the record, above all when you said so in advance. The wall is the same in both places when you leave no instructions and the provider offers no tool. The difference is whether the law hands your family a key or leaves them to ask a court for one.

RUFADAA has a built-in escape from all of this, and it is the hinge of the whole problem. The law says that if a company gives you an online tool to name someone who can access your account after death, and you use it, that choice governs, and it even overrides your will. The drafters expected the platforms to build these tools. A few platforms actually did this:

For those accounts, you can name a person today, and the law will honor it.

Now look at the chatbots. OpenAI, Anthropic, and Google’s Gemini hold some of the most intimate communications a person produces, and not one of them offers an online tool of this kind. There is no legacy contact for your ChatGPT history, no setting that says who may see your Claude conversations when you are gone. The path RUFADAA points to first, the simple in-product designation, is a door that was never built. That throws you back on the next option, an explicit clause in your will, which almost no one writes for a chatbot, and from there back onto a terms-of-service agreement that does not mention death at all.

I’ve spent a serious time in the policies and a consistent picture appears. These companies have written careful rules for retention, deletion, and training. They have written nothing for death.

OpenAI deletes your data within about thirty days once you ask, but the asking is gated behind logging in, and the request flow assumes the living account holder. Anthropic is the sharpest example. In September 2025 it moved consumer accounts to a model where, if you leave the training setting on, your conversations are retained for five years, up from thirty days, and conversations stay in your account until you delete them. The shorter clock and the deletion are both things only the account holder can trigger. A dead user cannot turn the setting off, cannot delete a thing, and cannot start the clock that would clear the record, so the default is that it sits for the full window. Google’s Gemini saves conversations by default, may have them reviewed by humans, and folds them into the wider Google account, and while Google’s Inactive Account Manager exists for the account as a whole, nothing makes clear it hands a designated person the substance of your Gemini chats.

The throughline is simple. By default the record persists, and the one action that would clear it, your own deletion, is the one action death takes away from you.

It is worth naming the cause precisely, because it is narrower than "AI." The problem is custody, meaning where the conversation lives and who holds it. A model running on your own laptop or phone, the on-device kind that spread quickly through 2026, leaves a record that sits on hardware you own, and that hardware passes to your heirs the ordinary way, the way a paper journal in a drawer always has. The lockout described here is a feature of centralized cloud custody, of handing the conversation to a company that holds it on its servers under its terms. The more your private thinking lives on someone else's computer, the more it falls into the gap this piece is about.

Put the pieces together and the answer is uncomfortable. Your family has no easy or automatic path. The Stored Communications Act blocks the company from handing them the content voluntarily, RUFADAA withholds it absent your prior consent, and there is no in-product tool to grant it. What they have instead is a trip to probate court to ask a judge to order disclosure, which a well-drafted will and a clear showing of need can win, and which costs time, money, and certainty that a grieving family often does not have. The door is not sealed but it is heavy, slow, and uncertain, and it opens only for the family willing to litigate to push it.

Two other parties have a far easier time. The first is a court. A dead person has little privacy interest the law will protect, and the same Stored Communications Act that bars voluntary disclosure to your family permits disclosure under legal process. If your conversations are relevant to a lawsuit, a will contest, an insurance fight, or a criminal case involving someone else, they can be subpoenaed, and there is no living person with standing to assert your privacy over them. The second is the company itself, which keeps the record under its terms and, depending on your settings, may continue to use it.

So the people with the easiest practical access to the most private archive you ever created are a litigant and the platform. The people you would actually choose, the partner or child or friend you might have wanted to read it, or to delete it unread, have the hardest road of anyone.

This has already happened in court. In the copyright case The New York Times brought against OpenAI, a federal court ordered the company to preserve ChatGPT conversations that users had deleted, suspending its usual thirty-day purge, and later ordered it to hand over 20 million anonymized chat logs.

What carried the ruling is the part to sit with: the court reasoned that the company's ownership of the logs was uncontested and that users had volunteered their messages, so the privacy interest gave way to the litigation's need. A court reached into deleted conversations, and the user's delete button did not stop it. The logs were ordered produced in anonymized form, which the court treated as the privacy safeguard, and the research on de-identification is not kind to that assumption, because a long, intimate conversation carries the shape of a single life even with the name stripped off, and the shape is often enough to reattach the name. That is a litigant getting access on a relevance argument, against the company's own privacy promises, while your family, asking for the same records after your death, would be turned away at the door.

The discovery problem is wider than that one case, and the courts have started to say so out loud. In a 2026 federal matter, United States v. Heppner, the court held that material a person generated with a public AI tool fell outside attorney-client privilege, because sharing it with a third-party service broke the confidentiality, and handing it to a lawyer afterward did not restore it. Family-law firms now warn clients in plain terms that chats with ChatGPT, Claude, or Gemini carry no privilege and can be subpoenaed in a divorce, and that deleting them once a dispute is likely can count as destroying evidence. OpenAI's own chief executive put it most bluntly, warning that people talk to these tools like a therapist or a lawyer or a priest, and that those conversations can be subpoenaed, which he called a real problem.

That inversion is the heart of the problem, and it is the part nobody is talking about while everyone debates the resurrection bots.

Until the companies build the tool RUFADAA assumes, the burden sits with you, and the steps are smaller than the problem.

1. Decide what you actually want, because inheritance is the wrong default to accept by silence. Some of this record you may want a trusted person to have. Some of it you would almost certainly want deleted, unread, the moment you are gone. Those are different instructions, and only you can give them.

2. Put it in your will in the right words. A general “my executor may handle my digital assets” line is not enough for this category. Because of RUFADAA and the Stored Communications Act, the content of your communications needs explicit, affirmative consent to disclosure, named as such. An estate lawyer in a RUFADAA state can write the clause that turns the default from withheld to granted, or, if you prefer, that directs deletion.

3. If you are in the EU, the instrument has a different name. France lets you lodge a post-mortem data directive with a notary or a certified third party that binds the provider in a way its terms cannot, and other member states are moving the same way, so check whether yours offers one and use it. Where your country has no such law yet, naming a trusted person and leaving clear written instructions is still the strongest lever you have.

4. Cover incapacity too, not only death. Have the same lawyer give a trusted person durable power of attorney over your digital accounts and the content of your communications, so that if you are alive but cannot act, someone can. This is the gap a will never reaches, and it is the more likely one.

5. Use any online tool that does exist for the rest of your digital life. Set Apple’s Legacy Contact, Google’s Inactive Account Manager, and Facebook’s legacy contact now. They take minutes and they override the slower machinery of probate.

6. Manage the record while you can, since you are the only one who can. If conversations matter to you, delete the ones you would not want to outlive you, and use the temporary or non-retained modes when you want a conversation gone by design. Check the memory and training settings while you are at it, since clearing a chat does not always clear what the system remembered or learned from it.

The pattern here is the same one that runs under most collisions between law and new technology.

• Every rule in this piece assumes a living person who can act, and act again. The right to delete assumes you will log in.

• The right to be forgotten assumes you will ask.

• RUFADAA assumes you set a tool or wrote a clause.

• The terms of service assume an account holder who is still here to agree.

A record that outlives the only person permitted to govern it is what falls through that assumption.

→ The fix is partly legal,

→ The clause in your will, partly technical,

→ The setting the companies have not shipped, and partly personal,

→ The decision about what you want done that no one can make for you.

The conversations are already written. And the only open question is who gets to read them, and you are, for now, the only one who can answer it, and only if you answer before you have to.

• Carl Öhman, The Afterlife of Data (University of Chicago Press, 2024). A short, readable book on what happens to our digital remains and who ends up controlling them, named a best book of 2024 by The Economist. The accessible companion to everything above.

• CNIL, Our Data After Us (2025), the French regulator’s foresight report on digital death, including how people actually fare when they try to exercise post-mortem data rights across major platforms. The most thorough official treatment in either jurisdiction.

• Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), Uniform Law Commission. The model law adopted in most US states, including the rule that a fiduciary reaches the content of electronic communications only with the user’s explicit consent, and the online-tool provision that overrides a will.

• The Stored Communications Act, 18 U.S.C. 2701 and following. The federal law that bars providers from disclosing the content of communications without lawful consent or legal process.

• GDPR Recital 27, on the data of deceased persons, which leaves the question to individual member states.

• Anthropic, Updates to Consumer Terms and Privacy Policy (September 2025), on the move to five-year retention for consumer accounts with the training setting on.

• OpenAI’s privacy policy and its right-to-be-forgotten and account-deletion help pages, on deletion gated to the living account holder.

• The death and legacy tools the other platforms did build, for comparison: Apple’s Legacy Contact, Google’s Inactive Account Manager, and Facebook’s legacy contact.

I write about legal architecture for AI products at Legal Layer. This piece is informational and does not constitute legal advice.