To access a deceased person’s online accounts, you generally need a certified death certificate, court-issued Letters Testamentary or Letters of Administration, your own photo ID, and any usernames or email addresses tied to the accounts. Then you submit those documents to each company separately through its deceased-user process. What you’ll receive is almost never a password. In most cases, it’s a data download, the ability to memorialize or close the account, or access to non-content records like contact lists and account logs. Federal privacy law blocks providers from handing over the contents of emails and messages unless the account holder authorized it in advance.
What You Can Actually Get
Set expectations before you start. Full login access is almost never granted, even to a court-appointed executor. Companies treat these requests as data-release decisions, not credential transfers, and each platform decides case by case what it will release.
Three outcomes are typical. You can request a copy of the account’s data, which the company packages and sends you. You can ask that the account be closed or, on social platforms, memorialized. And you can obtain non-content records, meaning the metadata around an account rather than the substance of communications. Whether you also get the contents of messages depends almost entirely on whether the deceased used a platform’s own legacy tool or included specific language in a will authorizing that release.
Documents to Gather Before You Contact Anyone
Every company asks for a similar packet. Assemble it once, then reuse it.
- Certified death certificate. Order multiple certified copies from the vital records office in the state where the death occurred. Fees generally run between $5 and $30 per copy. Each company holding an account may need its own.
- Letters Testamentary or Letters of Administration. This is the court order proving you can act for the estate. If there was a will naming you as executor, probate court issues Letters Testamentary. If there was no will, the court appoints an administrator and issues Letters of Administration. Filing fees vary widely, from under $50 to several hundred dollars depending on the jurisdiction.
- Government-issued photo ID. Your driver’s license or passport, to confirm you’re the person named on the court documents.
- Account identifiers. Email addresses, usernames, phone numbers, or profile URLs so the company can locate the right account.
Also read the will and any trust documents carefully. Specific language granting the executor authority over digital property strengthens your position and can be the difference between reading email contents and only being able to close the account.
The Laws That Shape What Companies Will Release
Two bodies of law govern these requests. One is state law, and one is federal.
Most states have adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act, known as RUFADAA. It gives estate representatives a legal path to manage digital property, but it works through a three-tier priority system. The top tier is any instruction the account holder left inside a platform tool, such as Google’s Inactive Account Manager or Apple’s Legacy Contact feature. Those instructions override everything else, including the will. The middle tier is a will, trust, or other written document with directions about digital assets, which applies when the deceased didn’t use a platform tool. The bottom tier is the company’s terms of service, which control when nothing else applies. Without an explicit grant of content access at the top or middle tier, RUFADAA generally limits fiduciaries to managing or deleting accounts and pulling non-content records.
The federal Stored Communications Act sets a ceiling on top of that. Under 18 U.S.C. § 2702, providers of email and cloud services are generally prohibited from disclosing the contents of stored communications to third parties. “Contents” means the substance of messages: the body of an email, the text in a chat, the words in a direct message. Non-content records are treated differently. The statute’s prohibition on releasing subscriber records and metadata applies only to disclosures to governmental entities, so providers are permitted to share things like message logs and contact lists with private parties, including estate fiduciaries.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records
That’s why a company might send you a contact list and account logs but refuse to release the actual emails. It isn’t the company being obstructive. It’s federal law drawing a line between metadata and content.
How the Major Platforms Handle These Requests
Each platform runs its own process on its own timeline. Plan on weeks per request, not days.
Google (Gmail, YouTube, Google Photos, Google Drive)
Google has a troubleshooter for deceased-user requests where you can ask to close the account, request funds from services like AdSense, or obtain a copy of the account’s data.2Google. Submit a Request Regarding a Deceased User’s Account Google will not provide passwords or transfer ownership. It reviews each request individually and decides case by case. A crucial sequencing point: if you request account closure first, Google will not process a later request for data. Ask for the data first.
If the deceased set up Google’s Inactive Account Manager, things move faster. That tool lets users designate up to 10 trusted contacts who each receive access to selected data after a chosen period of inactivity, with different data shared with different people and an option to have the account deleted after sharing.3Google. About Inactive Account Manager If you were named a trusted contact, Google verifies you using the phone number the deceased provided and sends a download link.
Apple (iCloud, Apple Music, Photos)
Apple’s Digital Legacy program lets users name Legacy Contacts who can request access to iCloud data after death. As a Legacy Contact, you need two things: a unique access key generated when the deceased added you as a contact, and a certified death certificate.4Apple. How to Add a Legacy Contact for Your Apple Account After Apple verifies the request, the Legacy Contact receives a special Apple Account to reach the deceased person’s photos, messages, notes, files, and device backups.5Apple. Legacy Contact Security
The access key is non-negotiable. Without it, no amount of other documentation gets a Legacy Contact in. Apple saves the key automatically on the contact’s supported devices, and it can also be printed and stored offline. If no Legacy Contact was ever set up, you’ll use Apple’s standard deceased-account process with your court documents, and the options will be narrower.
Facebook and Instagram
Facebook lets users choose a Legacy Contact who can manage their profile after it’s memorialized. Memorialization locks the account so no one can log in, but keeps the profile visible as a place to share memories.6Facebook. Legacy Contacts Even the Legacy Contact cannot log in or read private messages.7Facebook. Reporting a Deceased Person or a Facebook Account That Needs to Be Memorialized or Removed If no Legacy Contact was designated, no one can make changes to a memorialized profile.
Family members can also request full removal instead of memorialization through Facebook’s reporting process.7Facebook. Reporting a Deceased Person or a Facebook Account That Needs to Be Memorialized or Removed
PayPal
PayPal will only take instructions from the authorized executor or administrator. The paperwork is more extensive than most: a cover letter identifying the account by its primary email address, a death certificate, your photo ID, legal documentation naming you as executor, and a W-9 for the estate from the IRS.8PayPal. How Do I Close the PayPal Account of a Deceased Relative Any remaining balance can be issued as a check in the deceased person’s name or transferred to a bank account already linked to the PayPal account. Ownership of the funds cannot be changed.
Two-Factor Authentication Can Stop You After Approval
Legal authority and the right paperwork get you through the front door. Two-factor authentication can stop you at the second one. When an account requires a code sent to a phone the deceased carried, or a fingerprint that no longer exists, even a verified fiduciary cannot simply log in.
Handling varies. Some platforms will waive two-factor requirements once they’ve verified your documentation, though the process is slow and involves multiple rounds of identity checks. Others may refuse if the deceased never set up alternative recovery options.
Two practical moves help. Keep the deceased person’s phone active and charged, because the phone number is often the recovery channel. And search for backup codes. Most services that offer two-factor authentication generate a set of one-time backup codes when the feature is first turned on, and if those were written down or saved in a password manager, they can substitute for the phone. When nothing works, you’re back to the formal deceased-user process with court documents rather than a direct login.
Stop the Recurring Charges Right Away
While the longer account-access requests grind through, one thing needs immediate attention: stopping automatic payments. Streaming services, software, cloud storage, and app subscriptions will keep billing the deceased person’s cards indefinitely and drain the estate month by month.
Review recent bank and credit card statements for recurring charges. Notify the card issuer of the death and ask specifically about automatic payments tied to the account. Some issuers freeze the card, which stops new charges but may not cancel the underlying subscription agreements, so you’ll often still need to contact each service.
Most subscription services want a death certificate and proof of your authority over the estate. Contact customer support at each one, explain the situation, and request cancellation and closure. Amazon has a dedicated bereavement support team. Others, like Netflix or Spotify, handle these through general support. Documentation is similar across the board, but the specific steps differ enough that each company needs its own pass.
Cryptocurrency and Other Valuable Digital Assets
Assets with real monetary value add complications that a streaming subscription doesn’t. Cryptocurrency, monetized channels, domain names, and online business accounts can carry significant estate value and each has its own access problem.
Cryptocurrency is the hardest case. Access to crypto held in a self-custody wallet depends entirely on the private key. Whoever holds the key controls the funds. If the deceased stored the key on a hardware device or in a file no one else can find, those assets may be permanently unreachable. RUFADAA gives a fiduciary the legal right to manage digital assets, but legal authority means nothing when the cryptographic key is lost.
The tax angle makes this worse. Cryptocurrency in the estate is valued at fair market value on the date of death, and the estate may owe tax on that value even if no one can access the funds. The IRS does not carve out an exception for inaccessible assets, and it remains unclear whether an estate can claim a loss for crypto that becomes permanently unretrievable.
For crypto held on an exchange like Coinbase, the process resembles a bank account. The fiduciary contacts the exchange with court documents and a death certificate, and the exchange helps transfer or liquidate the holdings.
Guard Against Post-Death Identity Theft
A deceased person’s digital footprint is an ongoing identity theft risk. Obituaries and social profiles often contain enough personal detail, including full name, date of birth, and family members’ names, for thieves to open credit cards, apply for loans, or collect benefits in the deceased person’s name. This kind of fraud can run for years if no one is watching.
Notify the three major credit bureaus of the death and ask that the credit file be flagged. Contact the Social Security Administration to report the death so the number cannot be used on new applications. Review the deceased person’s social media profiles and consider memorializing or deleting them to reduce the personal information available to bad actors. If you discover that the deceased’s identity has already been misused, report it to the Federal Trade Commission and to local law enforcement.