How to Access a Deceased Friend's Phone, Photos, and Digital Accounts

Your friend died and their phone is sitting on the nightstand, locked. Every photo you took together, every voice memo, every text thread where they were most themselves — it's all behind a screen you can't unlock. The urge to just try their birthday as the passcode is overwhelming.

But here's what you need to know before you touch that device: accessing a deceased person's digital accounts without legal authority can violate platform terms and raise federal-law concerns, even if you know their password.

The Legal Framework You're Working Under

Most US states have adopted the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which controls who can access a deceased person's digital life. The law creates a strict hierarchy:

1. Platform legacy tools come first. If your friend set up an Apple Legacy Contact, Google Inactive Account Manager, or Facebook Legacy Contact, those designations override everything — including what their will says.
2. Estate instructions come second. If no legacy tool was activated, a will, trust, power of attorney, or other record may provide a fiduciary's consent to access digital assets, subject to state law.
3. Terms of service come third. Without either of the above, the platform's standard terms apply — and most default to denying access.
4. RUFADAA defaults come last. If everything else is silent, the law categorically denies access to the content of communications (actual emails, texts, DMs). A fiduciary only gets metadata: who sent what, when, to whom.

The critical point: a saved password or a friend's prior verbal permission does not replace the platform's process or establish post-death authority. Signing in can violate platform terms and raise Computer Fraud and Abuse Act (CFAA) concerns; whether the CFAA applies depends on the circumstances.

Platform-by-Platform: What You Can Actually Do

Apple (iPhone, iCloud, Photos)

If your friend named you as their Apple Legacy Contact, you'll need their death certificate and the unique access key they generated (digital or printed). This gives you access to photos, notes, emails, files, messages, and iCloud backups — but not Keychain passwords, payment details, or licensed media like purchased music.

If they didn't set up a Legacy Contact, Apple's U.S. process generally requires a court order naming you as the rightful inheritor of the person's personal information and identifying you as their legal personal representative, agent, or heir whose authorization constitutes "lawful consent." Apple cannot remove a device passcode lock without erasing the device; erasing it does not recover its data.

Google (Gmail, Photos, Drive)

Google's Inactive Account Manager lets a trusted contact download specific data categories after a user-defined inactivity period (3, 6, 12, or 18 months). If this wasn't set up, Google requires a formal request, death certificate, and often a court order to release any data.

Meta (Facebook, Instagram)

A Facebook Legacy Contact can manage the profile in a memorialized state — pin posts, change the profile photo, request deletion. But they cannot read private messages or remove existing posts. Without a Legacy Contact, anyone with the required documentation can request memorialization; an immediate family member or authorized representative can request deletion.

What to Do Right Now

Don't log in. Even if you know the passcode. Document what devices and accounts exist, then work through proper channels.

Talk to the executor or next of kin. They're the ones with legal standing to request access. If you need specific photos or messages, ask them to include your request when they file with each platform.

Check for legacy contacts. Ask the family if your friend ever mentioned setting up Apple Legacy Contact, Google Inactive Account Manager, or a Facebook Legacy Contact. Many people under 40 have these configured without mentioning it.

Memorialize social media. You can request memorialization from Facebook or Instagram without being next of kin by submitting the platform's required proof of death, such as a death certificate or obituary. A memorialized Facebook profile no longer appears in birthday reminders or "People You May Know," which can be deeply painful for mutual friends.

Preserve what you already have. Screenshot your own text threads, save shared photos from your devices, and download any shared albums or documents you already have legitimate access to. These are yours.

The digital estate process is slow and emotionally draining, but it protects your friend's privacy and keeps you on the right side of the law. If your friend's digital memories matter to you — and they clearly do — the legal route is the only one that actually works.

If you're navigating the broader landscape of losing a best friend — from the first week through the months ahead — the When Your Best Friend Dies toolkit walks you through the legal, logistical, and emotional steps that nobody prepares you for.