Post-Mortem Digital Identity: Legal Frameworks for AI Avatars After Death

4–9 weeks

Typical engagement

EU · UK · US · Global

Jurisdictions covered

Platforms · Memorials · Social

Who we work with

No unified framework

Post-mortem personality rights, digital inheritance, and data protection for deceased persons are regulated differently in every jurisdiction — and most frameworks weren't designed with AI avatars in mind. Germany protects personality rights for up to 10 years after death. France allows family members to enforce image rights. Most US states have no post-mortem personality protection beyond right of publicity. Building a platform that operates across these jurisdictions requires a consent and governance model that works in all of them.

Consent doesn't survive death automatically

A user who consented to their AI avatar during their lifetime did not necessarily consent to every possible post-mortem use. Consent given for family communication doesn't extend to commercial monetisation. Consent to store biometric data doesn't survive indefinitely under GDPR — the platform must have a legal basis for continued processing after death. Every use case needs to be explicitly addressed in the lifetime consent.

Family conflict is predictable

When a person dies, family members may have conflicting views on whether the avatar should continue to exist, who should have access, and what it should be used for. Without a documented user preference — and a platform policy that gives effect to it — platforms become the arbiters of intensely personal family disputes. That creates reputational and legal exposure that can't be managed reactively.

ℹ️ The most protective approach — and the one that builds user trust — is to treat the deceased person's documented preferences as binding, regardless of which jurisdiction's law would otherwise apply.

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Step 01 · Week 1

Platform and use-case mapping

We map your platform's post-mortem use cases: what happens to the avatar after the user dies, who can access it, what it can do, and who has authority over it. We identify every point where a legal or ethical decision is made — and whether it's currently governed by policy or improvised.

Step 02 · Weeks 1–3

Jurisdiction and consent analysis

We analyse the applicable post-mortem rights framework for your target jurisdictions and assess your current consent structure against each. We identify where lifetime consent is insufficient, where GDPR processing basis for deceased persons is unclear, and where family conflict is most likely to arise.

Step 03 · Weeks 3–6

Framework design and documentation

We draft the lifetime consent framework, digital will feature, terms of service update, and family request procedures. We design the conflict resolution mechanism and platform ethics policy. We prepare the legal basis documentation for post-mortem data processing.

Step 04 · Weeks 6–9

Implementation support

We support product and legal team implementation: reviewing the consent UX, briefing support teams on sensitive request handling, preparing public-facing documentation (FAQ, post-mortem rights policy), and advising on ethics committee structure if required.

Digital Legacy Platform · Germany

German platform enabling users to train a personal AI avatar (voice, appearance, communication style) for post-mortem family interaction. Operating in EU and UK. No formal consent structure for post-mortem use; risk of family conflict and regulatory challenge.

Memorial Platform · France

French provider of digital memorials and chatbots trained on user content. Conflicts arising between heirs over avatar deactivation, access, and continued chatbot use. No clear governance model for competing family requests.

Social Platform · USA/EU

Global social and AI platform with memorial account features and AI-generated content recommendations. Questions around using deceased users' data for model training, auto-surfacing content "from" deceased users, and family rights across jurisdictions.

GDPR explicitly does not apply to deceased persons — it only covers living individuals. However, this doesn't mean platforms can do whatever they want with deceased users' data. First, EU member states can extend data protection provisions to deceased persons under national law — Germany and France have done so to varying degrees. Second, the platform's terms of service and its own ethical commitments create binding obligations. Third, processing biometric data of a deceased person to run an AI avatar raises ethical and reputational issues that go beyond GDPR compliance. A robust post-mortem data framework addresses all three layers.

Post-mortem personality rights vary significantly by EU member state. Germany has the strongest protection: the Persönlichkeitsrecht survives death and can be enforced by heirs, typically for around 10 years (courts have extended this for public figures). France recognises family members' rights to enforce image rights after death. Most other EU member states have limited or no specific post-mortem personality protection beyond what national law may extend from GDPR. For platforms operating across the EU, the safest approach is to treat user preferences as binding and design the platform so that heirs can enforce them — regardless of what the local law would otherwise require.

This depends on what the user consented to during their lifetime. If the terms of service explicitly covered use of data (including post-mortem) for AI model training, and the user accepted those terms, the platform has a contractual basis — subject to GDPR compliance for the period when the user was alive, and member state law for the post-mortem period. If the terms didn't address this, using a deceased user's biometric data or personal communications to train models is ethically problematic and potentially legally challengeable by heirs. We recommend building explicit opt-in (or opt-out) for AI training into lifetime settings.

Ideally, the deceased user. A well-designed platform gives users the ability to designate a digital representative and specify their preferences before death — and makes those preferences binding on both the platform and family members. In the absence of explicit user preferences, the platform must make a governance decision: defer to the next of kin, apply a default policy (e.g., limited access for defined family members), or deactivate the avatar entirely. Without a documented policy, platforms become involuntary arbiters of family disputes, which creates both reputational and legal exposure.

A well-designed in-platform digital will lets users specify: who can access the avatar after death (named individuals, defined groups, or nobody); what formats of interaction are permitted (text only, voice, video); how long the avatar should remain active (defined period, indefinite, or until a representative requests deactivation); whether the avatar can be used commercially after death (typically prohibited without explicit consent); whether the underlying data can be used for AI model training after death; and what should happen if no representative is reachable (default deactivation after defined period). Each of these should be a separate, explicit choice — not a single consent.

The priority hierarchy should be: first, any designated digital representative appointed by the user during their lifetime; second, the executor of the estate if the digital representative is unavailable; third, documented family member hierarchy (spouse, children, parents) if no representative is designated. Where family members disagree and no designated representative exists, the platform's default policy applies — typically a conservative option (limited access or deactivation) that minimises the risk of the avatar being used in ways the deceased would have objected to. The policy must be documented in the terms of service and applied consistently.

In jurisdictions where post-mortem personality rights are heritable — California (right of publicity for 70 years), Germany (Persönlichkeitsrecht for ~10 years) — heirs can license commercial use of the deceased person's likeness, within the scope of those rights. In jurisdictions without specific post-mortem personality rights, the basis for heir consent is weaker — it may rest on copyright (if the avatar involves copyrighted works), contractual terms, or general estate authority. For platforms, the safest approach is to require explicit lifetime consent for any commercial post-mortem use — not to rely on heir consent as the primary authorisation mechanism.

There is no single regulatory ethics standard specifically for post-mortem AI avatars yet. However, the following principles are increasingly expected by regulators, ethicists, and the public: no creation of new content "from" a deceased person without explicit lifetime consent; no commercial monetisation of a deceased person's avatar without explicit lifetime consent; clear family access and control mechanisms; transparent disclosure to users about what happens to their avatar after death; and regular policy review to reflect evolving social expectations and regulatory guidance. Some platforms are establishing internal ethics committees or advisory boards to manage edge cases and maintain public trust.

Digital Likeness

Consent frameworks and B2B licensing structures for avatar platforms — three-party rights chains, withdrawal mechanisms, and biometric data compliance.

View service →

Digital Likeness

Structuring digital personas as intellectual property — trademark registration, copyright documentation, and monetisation frameworks for creators and brands.

View service →

Digital Likeness

Regulatory compliance for AI-generated content — EU AI Act disclosure, GDPR, and UK Online Safety Act obligations for synthetic media platforms.

View service →