Who Owns Digital Accounts After Death: RUFADAA and Executor Access

The Short Answer That Surprises Most Executors

Nobody "owns" the deceased's digital accounts in the way they own a car or a house. Digital accounts are governed by a patchwork of federal law, state law, and the platform's Terms of Service; a platform's online legacy tool can take priority over the will.

This means an executor with full legal authority over a physical estate can still be denied access to the deceased's email, social media, and cloud storage. Understanding why requires understanding RUFADAA.

What RUFADAA Actually Says

The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) has been enacted in 46 states plus the District of Columbia. It establishes a three-tier priority order for instructions about fiduciary access to digital assets:

Tier 1: Platform-level online tools. If the deceased set up a platform's built-in legacy tool — Google's Inactive Account Manager, Apple's Legacy Contact, Facebook's Legacy Contact — those selections hold absolute legal priority. They override the will, the trust, and any other estate planning document.

Tier 2: Wills and trusts. If no platform-level tool was configured, the estate planning documents control. But there's a critical limitation: generic language about "all assets" in a will is legally insufficient to compel platforms to disclose the contents of electronic communications. The deceased must have explicitly consented to disclosure of communications in writing.

Tier 3: Terms of Service. If neither platform tools nor explicit written consent exist, the platform's standard TOS governs. Most TOS agreements prohibit third-party access and credential sharing. Under this default tier, platforms routinely deny executor access.

The practical effect: most families fall into Tier 3 because the deceased never configured legacy tools or included specific digital asset language in their will. The executor has Letters Testamentary and full probate authority, but Google, Meta, and Apple say no.

The CFAA Problem With Using Saved Passwords

When platforms deny access through legal channels, families often turn to the obvious workaround: log in using the deceased person's saved passwords.

This approach has a legal risk. Logging in with saved credentials may violate the platform's Terms of Service. A Terms-of-Service violation alone does not automatically establish a federal Computer Fraud and Abuse Act (CFAA) violation; whether access is unauthorized depends on the circumstances.

The practical risk: if the platform detects a login from an unfamiliar IP address, it may permanently lock the account for suspected security breach. This makes subsequent legal access attempts harder, not easier, because the platform now treats the account as compromised.

What Executors Can and Cannot Access

RUFADAA distinguishes a catalogue of electronic communications from their content:

Catalogue information — the people someone communicated with, dates and times, and electronic addresses — can be disclosed to fiduciaries with the required legal documents, such as Letters Testamentary or Letters of Administration and a death certificate.

Content of electronic communications — the actual text of emails and private messages, including attachments — requires the deceased's explicit consent for disclosure under RUFADAA. Other digital assets, such as photos or documents stored outside messages, are handled separately under the applicable state law and provider process.

This distinction means an executor may be able to learn that the deceased exchanged messages with a life insurance company on a specific date, but cannot read those messages without the required consent.

Platform-Specific Procedures

Each major platform has its own process for handling accounts after death:

Google (Inactive Account Manager): If configured pre-death, designated contacts receive data from selected services after an inactivity period. If not configured, immediate family members or representatives can ask Google to close the account or request data. Google reviews each request, may provide content only in certain circumstances, and does not provide passwords or login details.

Apple (Legacy Contact / Digital Legacy): If configured, a legacy contact uses an access key plus the death certificate to request access to certain account data. If not configured, an executor can request access with a court order; Apple may require the order to identify the account and the requester's authority, and it may not be able to provide some end-to-end encrypted data.

Facebook / Meta (Legacy Contact / Memorialization): The deceased's pre-designated Legacy Contact can manage the memorialized profile. Without a Legacy Contact, family members can request memorialization or account deletion but cannot access private messages or content.

Microsoft: Executors seeking Outlook.com content must formally serve Microsoft with a valid subpoena or court order. Microsoft reviews each request and may still be unable to provide account content. Account closure is separate; accounts are closed after two years of inactivity.

State-by-State Variations

While 46 states have adopted RUFADAA, each state's enactment includes local variations:

• Some states added additional consent requirements beyond the uniform act
• A few states haven't adopted RUFADAA at all, leaving digital estate access to common law and platform TOS
• State-level differences in what constitutes valid written consent affect whether a will's digital asset clause actually works

The specific language needed in a will varies by state. A clause that satisfies RUFADAA in California may be insufficient in a state with additional consent requirements.

What Families Should Do Now

For anyone managing a memorial or estate, three steps reduce the access problems:

1. Identify which platforms the deceased used and check whether legacy tools were configured (Google's Inactive Account Manager settings, Apple's Legacy Contact, Facebook's Legacy Contact)
2. Secure physical devices immediately — keep phones charged and connected to receive two-factor authentication codes while you still have access
3. Do not log into accounts using saved passwords — document what passwords you find, but use the platform's official deceased-user process instead

For anyone doing estate planning while alive, the fix is straightforward: configure platform legacy tools (Tier 1) and include explicit digital asset consent language in the will (Tier 2). Both steps should reference content access specifically, not just metadata.

The memorial website toolkit includes a platform-by-platform checklist for post-death account access, a RUFADAA summary, and the communication scripts needed to request data from major platforms.