Legal Access to Deceased Digital Accounts: CFAA, Stored Communications Act, and Executor Rights

The Short Answer Nobody Wants to Hear

Using a deceased person's password can violate platform terms and raise questions under unauthorized-access laws. An executor appointment or family consent does not by itself guarantee that a provider can disclose communications. This surprises nearly everyone, and it's one of the most consequential blind spots in estate administration.

Two federal statutes create the problem: the Computer Fraud and Abuse Act (CFAA) and the Stored Communications Act (SCA). Both were written decades before digital estate planning existed, and neither accounts for grieving families trying to recover a locked Gmail inbox.

The Computer Fraud and Abuse Act and Executors

The CFAA criminalizes "unauthorized access" to computer systems. Platform terms of service almost universally prohibit sharing credentials or transferring account rights. A deceased person's password alone does not establish that an executor is authorized to access the account under the applicable law or platform process.

An executor who logs in using known credentials may violate platform terms or face questions under unauthorized-access laws. A login can also trigger security controls or make later formal recovery harder.

Alongside potential legal questions, the practical risk is that a login may trigger security checks or a lock. The provider's response depends on its process, and a login can complicate a later formal request.

The Stored Communications Act and Content Access

The SCA creates a separate barrier. It prohibits service providers from disclosing the contents of electronic communications — the actual text of emails, direct messages, chat logs — to third parties without the user's explicit prior consent.

A general appointment as executor is not enough. RUFADAA (the Revised Uniform Fiduciary Access to Digital Assets Act, adopted in nearly all US states) distinguishes between:

• Catalog of communications: Metadata like sender names, dates, subject lines, and timestamps. Executors can request this.
• Content of communications: The actual body text of emails and messages. This requires either explicit consent in the deceased's will or a specific court order.

In Ajemian v. Yahoo!, the platform successfully argued that the SCA barred disclosure of email contents, even to an appointed personal representative. New York Surrogate's Court cases (Matter of Serrano, Matter of White) ordered platforms to release contact lists and calendar metadata but upheld restrictions on message content.

RUFADAA: What It Actually Gives You

RUFADAA was designed to fix this problem, and it helps — but less than most executors expect. It establishes a three-tier priority system:

Tier 1 — Platform-level directives. If the deceased set up Google Inactive Account Manager, Apple Legacy Contact, or Facebook's Legacy Contact, those settings override everything. The platform follows the user's own configuration.

Tier 2 — Will or trust provisions. If the will contains explicit language authorizing digital asset access, this governs — but the language matters. Vague phrases like "I leave all my property to my spouse" typically don't cover digital accounts. The will needs to specifically reference digital assets, digital accounts, or electronic communications.

Tier 3 — Terms of service. If neither Tier 1 nor Tier 2 applies, the platform's standard terms control. Most terms prohibit posthumous access entirely.

The gap between what RUFADAA promises on paper and what platforms actually do in practice remains wide. Google, Apple, and Meta have cooperated more readily in recent years, but smaller platforms, international services, and cryptocurrency exchanges often ignore RUFADAA entirely.

How to Access Accounts Legally

Step 1: Do not log in with the deceased's passwords. Resist the urge, even if you know the credentials.

Step 2: Secure physical devices. Keep phones charged, laptops locked in a safe location, and hardware wallets secured. Do not power off devices that are currently unlocked.

Step 3: Gather your legal documents. Prepare a certified death certificate, Letters Testamentary or Letters of Administration, and your government-issued photo ID. Letters should be dated within 60 days of submission; check each provider's process for copy requirements.

Step 4: For email content specifically, you likely need a court order. Petition the probate court for an order that specifically names the deceased, identifies you as the authorized representative, names the platform, and states that the disclosure constitutes "lawful consent" under the SCA. Platforms like Google and Yahoo have specific language requirements — if the order doesn't use their preferred phrasing, they'll reject it.

Step 5: Submit formal requests through each platform's dedicated deceased-user process. Google, Apple, Meta, Microsoft, and Yahoo all have specific portals. Going through the front door is slower but produces results the platform will honor.

What About the UK, Canada, and Australia?

UK: The Property (Digital Assets etc.) Act 2025 established digital assets as a "third category" of personal property under English law, which strengthens executor claims. The SCA and CFAA don't apply, but platform terms of service still create friction.

Canada: The Uniform Access to Digital Assets by Fiduciaries Act (UADAFA) affirms that standard fiduciary powers extend to digital assets, but adoption varies by province.

Australia: No uniform digital asset statute exists. Executors rely on general property principles, and the Privacy Act 1988 restricts disclosure of personal data post-mortem. The Criminal Code Act 1995 criminalizes unauthorized access.

The Digital Estate Toolkit includes platform-specific request templates with the exact legal language each service requires, plus a court order petition template your attorney can file directly.

The Bottom Line

The safest path is the official one: death certificate, Letters Testamentary, formal request to each platform. It takes longer than simply logging in, but it protects you from account lockouts, legal liability, and permanent data deletion that happens when platforms detect unauthorized access.