United States: RUFADAA and online accounts after death

Almost every US state has adopted a model law called RUFADAA, which sets who can reach a dead person’s online accounts.
A provider’s own tool, such as Google Inactive Account Manager, beats your will. Your will beats the terms of service.
By default an executor can get a list of who you emailed and when, but not what the messages said.
Once a provider has everything it needs, the model law gives it 60 days to comply.

In the US, access to a dead person’s online accounts is governed mainly by state law. This page explains it in plain words. It is general information, not legal advice.

What the law says

RUFADAA in brief

The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) is a model law published by the Uniform Law Commission in 2015. It applies in a state only once that state’s legislature passes it. A California Senate analysis from April 2024 counted 45 states, DC and the US Virgin Islands with the full Act, plus California in part. Oklahoma adopted it later that year, with effect from 1 November 2024.

It covers people who act for someone else: executors and administrators (the law calls them personal representatives), agents under a power of attorney, conservators and trustees. It does not create a separate “digital executor” role.

Three levels of priority

When a provider (the law calls it a “custodian”) decides whether to release your data, it follows this order:

The provider’s online tool. If you used a setting such as Google Inactive Account Manager or a Facebook legacy contact, that choice wins, even over your will.
Your will, trust, power of attorney or other record. This applies if the provider has no such tool or you didn’t use it.
Terms of service. With no direction from you at all, the provider’s own terms decide.

Whoever acts for you gets no greater rights than you had, and stays bound by the terms of service.

Content versus catalogue

	Catalogue	Content
What it is	Who you communicated with, when, and their address	What the messages said
Default for the executor	Released, unless you prohibited it or a court says otherwise	Not released
What unlocks it	Standard documents (see below)	Your consent, in an online tool or in a will or other record

Not everything stored online counts as a communication. In In re Scandalios (2019), a New York court ordered Apple to give a surviving husband access to photos in the deceased’s iCloud, holding that photos are not electronic communications needing consent.

Why the split exists

A federal law, the Stored Communications Act (18 U.S.C. § 2702), bars providers from knowingly revealing the contents of stored communications, except with the lawful consent of the subscriber (among others). Non-content records can be released more freely. RUFADAA builds on this: it releases content only with your consent, given in your will or through an online tool, which is meant to supply that lawful consent. Meta cites the same Act when it refuses to give families private messages.

States that do it differently

California adopted its own modified version in 2016, keeping the three-tier priority. At first it covered only deceased users. Since 1 January 2025 it also covers agents under a power of attorney and conservators.
Louisiana has its own rule, Code of Civil Procedure article 3191. A succession representative can take control of, handle or close any digital account of the deceased. Providers must give access within 30 days of receiving the death certificate and letters testamentary, or a court order appointing the representative, whatever their terms of service say.
Massachusetts had not passed RUFADAA as of its bill’s last recorded step on 17 November 2025.

Knowing the password is not the same as having permission. RUFADAA treats an executor acting within their role as an “authorized user” for computer-fraud laws, but they may not pose as the account holder. The Uniform Law Commission’s own commentary warns that federal courts applying the Computer Fraud and Abuse Act may not treat that state rule as the final word. Use the provider’s official process.

What it means if you are planning ahead

Set up the online tools first. They override your will, so they are the most direct way to choose who gets what. See our guides to Google Inactive Account Manager and Apple Legacy Contact.
Give or refuse consent in your will or trust. If you want your executor to read your emails, say so explicitly. Without that, the default is no access to content.
Choose the person. You can name someone in an online tool, or give a named executor or trustee authority over digital assets. Our page on naming a digital executor covers the options.
Keep passwords out of your will. American Bar Association guidance recommends keeping credentials separate, for example in a password manager, and keeping an up-to-date inventory of your accounts. A letter of instruction is a good place for it.

As a side note on tax, the IRS sets the federal estate tax basic exclusion for 2026 at $15,000,000 per person.

What it means for executors and family

To request content under RUFADAA, you send the provider:

A written request, on paper or electronically.
The death certificate (a certified copy).
Your letters of appointment (a certified copy), or a small-estate affidavit or court order.
Unless the deceased used an online tool, a copy of the will, trust or other record showing they consented.

For the catalogue and other assets, items 1 to 3 are enough. The provider may also ask for the username or account number, evidence linking the account to the deceased, or a court finding, for example that disclosure is reasonably necessary to administer the estate.

The provider can give full access, partial access or a copy, may charge a reasonable fee, and doesn’t have to disclose anything the person deleted. If it hasn’t complied in time (60 days in the model law), you can apply to court.

In practice, large providers often want a court order for content. If Google approves a request for a deceased user’s data, it asks for a US court order, and Apple asks for one with specific wording if there is no Legacy Contact. Ask for data before you ask for closure: Google says that once an account is closed, it can’t hand over its contents later.

Documents usually needed

Get several certified copies of the death certificate, plus the court document confirming your appointment. Smaller estates may use a simpler procedure, with limits set by each state. Our page on the documents you need after a death goes through each one.

If a decision depends on how your state applies these rules, a local attorney can confirm it for your situation.