Who Can Access a Dead Person's Online Accounts? What State Law Says

A common surprise for executors: being legally in charge of an estate doesn’t mean you can simply log in to a person’s email or social media. The rules come from three places: the person’s own instructions, state law, and each company’s terms of service. This guide explains how they fit together. For platform-specific steps, see our guides to Facebook and Instagram, Google, and Apple.

Why can’t I just log in?

Most online services are governed by terms of service the person agreed to, and many prohibit sharing logins or transferring accounts. Guessing passwords or working around security can also raise legal problems under unauthorized-access laws. The safer path is the company’s official process or the person’s own advance setup. See can your family access your email and should you leave your passwords to someone.

What does the law say?

Most states have adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act (often shortened to RUFADAA), written by the Uniform Law Commission in 2015. Texas enacted it as chapter 2001 of its Estates Code, effective September 1, 2017. California and the District of Columbia have also enacted versions (D.C.’s is D.C. Law 23-189, from 2020). We did not survey other states, and enacted versions differ in details, so check yours.

The act gives a three-layer priority to resolve conflicting instructions:

1. The person’s instructions in an online tool. If the company provides an online tool, separate from its general terms of service, that lets the person name someone to access their digital assets, or direct the company to delete them, those instructions are legally enforceable. If the tool lets the person change or delete the direction at any time, it overrides a contrary direction in a will
2. Instructions in a will, trust, power of attorney, or other record. If the company has no online tool, or the person didn’t use it, the person can give legally enforceable directions in an estate planning document
3. The company’s terms of service. If the person gave no direction either way, the terms of service control whether a fiduciary may access the account. If the terms don’t address it, the act’s default rules apply

What kinds of access are there?

The act distinguishes between types of digital assets, which matters a great deal:

• The content of electronic communications, such as the text of emails and messages. This is the most protected. Generally, a fiduciary gets it only if the person consented (for example in a will or through an online tool) or a court orders it, and federal privacy law also limits what companies may disclose
• A catalogue of electronic communications, which means a record of who the person communicated with and when, without the content. A fiduciary can generally get this more easily
• Other digital assets, such as photos, documents, and files, which a fiduciary can generally access under the act’s default rules unless the person prohibited it

The act gives the fiduciary a way to ask for disclosure of the account’s assets, but in practice the company decides how to comply. The Texas bill analysis notes the company may, at its sole discretion, give the fiduciary access or provide a copy of the records.

Who counts as a fiduciary?

For a deceased person, usually the personal representative: the executor or administrator appointed by the court. The act also covers guardians, agents under a power of attorney, and trustees. Texas’s version doesn’t apply to a digital asset an employer owns and an employee uses in the ordinary course of the employer’s business.

What can a company require?

Companies generally want to confirm that you’re authorized before releasing anything. Expect to provide a written request, proof of death, and proof of your authority, such as letters from the court; a will or other record if you rely on the person’s consent; and sometimes a court order. The act lets a custodian require a court order containing findings, for example (in the D.C. version) that the person consented to disclosure of content unless an online tool was used, or that disclosure is reasonably necessary to administer the estate. See what letters testamentary are.

What should I do as an executor?

1. Make a list of the accounts from email, bills, and devices, without logging in
2. Check for the person’s own instructions first: a legacy contact, Inactive Account Manager, or other online tool, then the will and any digital plan
3. Use each company’s official process and ask for what you need, such as closing an account, preserving content, or getting a copy
4. Ask an attorney whether a court order is worth pursuing for something important, such as irreplaceable photos or business records
5. Don’t delete anything yet if you may need it later. Some companies can’t turn over content after an account is closed; see our guide to Google accounts

How can I make this easier for my own family?

• Use each platform’s own tool: a legacy contact on Apple and Facebook, and Inactive Account Manager on Google. See digital legacy planning in advance
• Say in your will whether your executor may access the content of your communications, and name a digital executor if you like
• Keep a list of your accounts, and where an executor can find it, in a place your family can reach
• Add this to your Final Day Plan under your affairs: which accounts you have, who should handle them, and what you want done with them

Digital access laws differ by state, and federal privacy law and each company’s rules also apply. This is general information, not legal advice; the executor’s attorney can tell you what applies to a particular account.