Under the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), an executor gains authority to access a deceased person’s online accounts only when the estate planning documents contain specific consent language for disclosure of electronic communications. A generic clause granting power over “all property” will not do it, because federal privacy law blocks providers from releasing the content of emails and messages without the user’s own consent. RUFADAA executor authorization is the mechanism that supplies that consent inside a will, trust, or power of attorney.
Without it, the executor is usually looking at a court petition, months of delay, and legal fees that a few paragraphs of drafting would have avoided.
Why a Generic Will Clause Fails
The reason executors cannot simply show a death certificate and read a deceased person’s emails comes down to one federal statute: the Stored Communications Act. Under 18 U.S.C. § 2702, any company providing email or cloud storage to the public is prohibited from disclosing the contents of stored communications to anyone.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records Google, Apple, Meta, and Microsoft all fall under this rule. Even when a company wants to cooperate with a grieving family, handing over email content without legal authorization exposes it to liability.
The statute carves out a narrow exception: a provider may disclose content with the “lawful consent” of the user.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records RUFADAA plugs into that exception. When estate documents contain specific authorization language, that language operates as the deceased user’s lawful consent and clears the way for the provider to release content.
RUFADAA itself draws a line between two kinds of information inside a communication account. The catalogue is the log of who sent or received a message and when. The content is the actual text, the attachments, and the private messages.2Uniform Law Commission. Revised Uniform Fiduciary Access to Digital Assets Act Catalogue information can be released on a general grant of fiduciary authority. Content cannot. That is where the specific consent language does its work, and where generic estate planning falls apart.
The Priority Order That Decides Who Wins
RUFADAA sets a three-tier hierarchy for deciding who controls a person’s digital assets. Each tier overrides everything below it.
- Tier 1 — Online tool settings. If a platform offers its own legacy feature, such as Google’s Inactive Account Manager or Apple’s Legacy Contact, and the user actually sets it up, those instructions take top priority. They override anything in the will, trust, or power of attorney.
- Tier 2 — Estate planning documents. If the user did not use an online tool, specific instructions in a will, trust, or power of attorney govern. When those documents grant fiduciary access to digital assets, the provider’s terms of service no longer control.
- Tier 3 — Terms of service. If the user left no instructions through either channel, the contract between the user and the platform fills the gap. This default usually favors deletion or minimal access.
The logic is that the most recent, most specific choice wins. Someone who names a legacy contact through Google’s settings has made a deliberate, platform-specific decision that trumps a general clause in a will drafted years earlier. Both of those trump the boilerplate contract the user clicked past without reading.
The practical consequence for drafting: check what the client has already done inside the major platforms before finalizing the estate plan. A carefully drafted authorization in the will accomplishes nothing for a Google account if the client already designated a different person through Inactive Account Manager. Google’s tool lets a user name up to 10 trusted contacts and choose which categories of data each one receives, or instruct Google to delete the entire account after an inactivity period.3Google. About Inactive Account Manager Apple’s Legacy Contact program gives designated contacts access to iCloud data including emails, photos, notes, and backups, but not to purchased media, Keychain passwords, payment cards, or the device passcode. Facebook lets a legacy contact manage a memorialized profile but never read private messages or log in as the user.
If the client wants full executor access to everything, the platform tools alone will not get there. The estate documents have to carry the weight, and login credentials often need to be shared through a separate secure channel.
Authorization Language the Will or Trust Needs
Effective authorization language does three things.
First, it explicitly states that the user authorizes the fiduciary to access, manage, and if necessary delete digital assets and online accounts. Second, it specifically references the content of electronic communications, not just accounts in general. Without that distinction, providers will release the catalogue but refuse to release the actual messages. Third, it states that the user’s consent is intended to satisfy any federal or state law requiring user authorization for disclosure.
A stripped-down version reads along these lines: “I authorize my personal representative to access, copy, and manage my digital assets, including the content of my electronic communications, and I consent to the disclosure of such content by any custodian holding those records. This authorization is intended to constitute lawful consent under applicable law.” An estate planning attorney will tailor this to the specific state’s version of RUFADAA, but the three core elements remain constant.
One warning matters more than any drafting detail: never place passwords, usernames, or security answers in the will itself. Once a will is admitted to probate, it becomes a public court record open to anyone. Credentials belong in a separate, secure document, such as a sealed letter held by the attorney, a password manager with a shared vault, or a digital estate planning service. The will or trust should reference that separate document and give the fiduciary authority to use it, without listing any of it.
Power of Attorney During Incapacity
RUFADAA is not only a post-death statute. It also governs digital asset access while the account holder is alive but incapacitated. A durable power of attorney that includes digital asset language lets an agent manage online accounts, cancel subscriptions, and handle cryptocurrency while the principal cannot act.
The same specificity applies. A power of attorney granting authority over “financial matters” will not compel a provider to release email content. The document must name digital assets explicitly, authorize access to electronic communications content, and include the same lawful-consent language that satisfies the Stored Communications Act. As with the will, the document should reference where the principal has stored login credentials rather than listing them.
What the Executor Sends to the Custodian
When the executor is ready to contact a custodian, they need a documentation package. Requirements are largely uniform across RUFADAA states:
- A written request, either a formal letter or the provider’s online form, identifying the specific digital assets sought.
- A certified copy of the death certificate.
- Letters testamentary or letters of administration, confirming the executor’s authority.
- The section of the will or trust containing the digital asset authorization language, demonstrating the user’s consent to content disclosure.
- Account identifiers: username, email address, phone number, or account ID tied to the service.
Most major platforms provide dedicated portals or forms where the executor can upload scanned copies of these documents. Verification typically runs 30 to 90 days, and custodians often request additional documentation during the process. Keep copies of every submission and note dates, because follow-up requests are common.
If the estate documents lack authorization language, or if the custodian disputes the request, a court order becomes necessary. The court must specifically find that the deceased had an account with the custodian and that disclosure is reasonably necessary for estate administration. Some courts also require a finding that disclosure would not violate the Stored Communications Act, which circles back to the consent issue the will should have solved in the first place.
When a Custodian Still Refuses
RUFADAA requires custodians to comply with valid requests, but it does not specify a penalty for noncompliance. Some companies stall, demand documentation beyond what the statute requires, or refuse outright. Custodians receive statutory immunity for good-faith compliance with RUFADAA, which sometimes pushes them toward caution rather than cooperation. They would rather demand a court order and let a judge decide than risk making the wrong call.
RUFADAA also gives custodians discretion to request a court order if they consider a request burdensome, and to determine the level of access (full account, partial data, or a copy of records) when a court order does not specify. Some companies treat that discretionary provision as a default requirement, forcing executors into court even with complete documentation.
When a custodian refuses, the executor’s remedy is a court petition compelling disclosure. Courts have enforced these requests and have threatened contempt proceedings against companies that resisted after an order was issued. Filing fees vary by jurisdiction; attorney time is the real cost. Weigh the value of the digital assets against the cost of litigation. For a cryptocurrency wallet worth six figures, a court petition is straightforward. For a social media account with sentimental photos, the platform’s own data download tool may be the cheaper option.
If resistance from a specific provider is likely, submit the fullest documentation package possible on the first attempt. Include the death certificate, letters testamentary, the relevant pages from the will showing authorization language, and precise account identifiers. Every missing piece gives the custodian a reason to reject the request and restart the clock.
What RUFADAA Authorization Does Not Solve
RUFADAA governs access to accounts held by custodians. It does not defeat device-level encryption. A locked iPhone or encrypted laptop may hold the only copies of cryptocurrency keys, stored passwords, or personal files, and no death certificate or court order compels Apple to bypass a device passcode. Apple can assist with iCloud through the Legacy Contact program or a court order, but the company cannot remove a device passcode without erasing the data on the device.
Biometric unlocking looks like a shortcut and is not one. Most devices require the passcode after a restart, after 48 hours of inactivity, or after several failed biometric attempts, and by the time a family member thinks to try, the phone has almost certainly locked to passcode-only. The lesson is prevention: the passcode, stored securely outside the will alongside other credentials, is often worth more than any legal document when device-level data is at stake.