A model law from 2015 decides most of this, and 47 states plus the District of Columbia had enacted it by July 28, 2026. Three separate systems apply at once, and they don’t always agree.
Each company writes its own rules for a death, and those rules include settings you can set while you’re alive. State law sits on top of them. Every one of those state laws is that state’s own version of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA). Federal privacy law and federal computer-crime law then draw an outer boundary around both, and neither one can cross it.
The Stored Communications Act dates from 1986, and the Computer Fraud and Abuse Act sits beside it in the same federal code. The 1986 act carves out no exception for death. Law professor David Horton, writing in the Vanderbilt Law Review, concluded that Congress never considered managing property at death when it wrote the act.
Ranking the three systems against each other is the job the state act does, and its answer still surprises most people. A signed will doesn’t come out at the top.
Platform rules do most of the daily work, because a company applies them on its own without anybody going near a court. Nobody outside the company reviews that decision. Meta, Google, and Apple each run a different process, and each one asks for its own stack of documents and proofs. The paperwork comes next, and nearly every process asks for the same two documents.
Where the state act applies, it doesn’t replace a company’s rules so much as tell that company whose instruction has to win. That order is worth knowing before you start. Whether it changes the outcome for one particular estate is a question for the lawyer handling that estate, not for a website.
The setting they clicked outranks the will they signed
Under the act, a direction the person left inside a platform’s own online tool comes ahead of every other instrument they left. That even covers a will signed years afterwards.
One condition attaches to that top rank, and it’s the part most summaries of the law leave out of the story. The tool has to allow changes at any time. A permanent choice made once, buried somewhere in a signup flow, doesn’t reach the top rank under the act’s wording. Facebook’s legacy contact, Google’s Inactive Account Manager, and Apple’s Legacy Contact all belong in that top group under RUFADAA.
Where the person left no online-tool direction, the will, the trust, or a durable power of attorney governs the account instead. Those documents make up the second tier. Where none of them exists either, the company’s terms of service govern, and the act’s own defaults fill whatever gap is left over.
Financial-planning commentator Michael Kitces describes each platform setting as a small testamentary instrument that people execute casually and rarely inventory. Almost nobody keeps a written list of their own settings.
The Uniform Law Commission drafted the act, and its own rationale reads that same arrangement in the opposite direction. A setting is recent and specific. It records what the person said about that one account, rather than what they told a lawyer about an estate years earlier. This site takes no side between the two readings, and the disagreement matters mainly to whoever drafts the estate documents.
So a will drafted with care in a lawyer’s office can lose to a setting clicked in a hurry three years earlier. The drafters of the act built that result on purpose. An executor can’t create one of these settings after a death, so whatever the person left in place is what a company reads.
Who they messaged, and what the messages said
RUFADAA splits what’s inside an account into two piles, and the distance between those piles decides how hard a request gets. One pile is much easier to reach than the other.
The catalogue is the record of who the person messaged, when they did it, and at what address they used. It leaves out every word anybody wrote. A documented fiduciary gets the catalogue by default under the act, and that part of it needs no court order. For a family tracing accounts, subscriptions, and unpaid bills, the catalogue on its own often does the entire job.
Content is the words inside the messages themselves, and the act guards it far more tightly than it guards the catalogue. Two routes reach the second pile. A custodian may disclose content where the person recorded their consent in advance, and otherwise the route runs through a court order.
Recorded consent is narrower than it sounds, because a boilerplate power of attorney doesn’t supply it on its own. The act asks for an express grant of that particular authority.
That split explains a pattern families run into with the big providers over and over again, at every stage. Google asks for a court order in the United States before it will release message content from an account. That requirement comes from Google’s own support pages. A catalogue request follows the act’s default track, and a content request can turn into a separate court proceeding of its own.
So it pays to work out what your family really needs before asking a company for all of it at once. Bills and dormant accounts live in the catalogue. Reading a parent’s letters is a different request, and a company that refuses can hold that line for months.
What a documented request produces
Four items make up the documentation baseline a custodian asks for under the act, and almost every platform process starts there. None of those four items is a password.
A written request comes first, then a certified death certificate, then the letters of appointment issued by a probate court. Evidence of the user’s consent completes the set. Companies differ on what they’ll take as proof of appointment, and LinkedIn draws the sharpest line of the ones this site examined. It takes court-issued letters of administration and turns away wills, trusts, powers of attorney, identity documents, and screenshots outright.
The custodian decides what comes back, and you get no say at all in the form it takes. A copy of the data counts as compliance. The act allows full access, partial access, or a copy of the data, and the company picks whichever of the three it prefers.
A copy of the data can substitute for login access, and every platform examined for this site stops short of handing over credentials. So plan the request around what a copy can do.
The act sets a 60-day clock on compliance once a custodian holds a properly documented request from a fiduciary. That clock doesn’t settle the question. A custodian also keeps the option of asking a court to order the disclosure instead of answering the request itself. Companies do use that option, and an estate lawyer is the person to ask about what pushing back is likely to cost.
The act’s own text sets out this order of priority in full. Your own state’s version of it may read differently. Where each state stands changes the wording, the section numbers, and now and then the answer itself.
No company hands over a password
No platform examined for this site releases login credentials, and two of the big providers say so in plain words. The two refusals read almost word for word alike.
Google says on its support pages that it can’t provide passwords or other login details for a dead user’s account. Apple builds a separate legacy account instead. X says it can’t provide account access to anyone at all, whatever their relationship to the person who died. Amazon and Snapchat run the documented exceptions, and both of them presume or invite the use of the account holder’s own credentials.
So access, across every documented process examined for this site, turns out to mean one of three much narrower arrangements. The password itself never travels. Your family gets a limited role on a memorialized profile, a download of the data, or a separate account opened for a beneficiary.
Signing in with a password the family already holds looks like the obvious shortcut around every bit of this. The research behind this site found no reported prosecution of a survivor for doing it.
A 2016 Ninth Circuit ruling placed authorization under the federal computer-crime statute with the system owner rather than the account holder. No reported case applies it to an executor. A 2022 Department of Justice charging policy steps back from contract-based theories, and it never mentions survivors at all. Logging in with their password sets out the rest of that record in detail.
The documented route is slow, but it’s the one route a custodian will answer without an argument. Start it before anybody tries a login. Ask the lawyer handling the estate which accounts earn the paperwork, open those requests first, and let the rest wait.