The Revised Uniform Fiduciary Access to Digital Assets Act, known as RUFADAA, is a state law that lets a person’s executor, trustee, agent under a power of attorney, or court-appointed guardian request access to that person’s online accounts and digital files after death or incapacity. More than 40 states have adopted a version of it. The law works alongside federal privacy statutes rather than overriding them, and it gives both fiduciaries and service providers a shared procedure for handling accounts that traditional probate rules never contemplated.
The practical effect is a tiered system. The user’s own choices come first: anything they set up inside the platform (a legacy contact, an inactive-account instruction) controls. If they left no platform instructions, their will, trust, or power of attorney controls, provided it specifically addresses digital assets. If neither exists, the provider’s terms of service decide what happens, and the default is usually that no one gets in.
What the Law Treats as a Digital Asset
RUFADAA defines a digital asset broadly as any electronic record in which a person has a right or interest. That covers email accounts, social media profiles, cryptocurrency wallets, domain names, cloud-stored documents, digital photographs, loyalty point balances, and online business storefronts. The definition is intentionally wide so that new categories of digital property do not fall outside the law as technology changes.
One boundary matters at the outset. The law does not reach digital assets belonging to an employer that an employee uses in the ordinary course of business. A company-issued email account or a corporate social media profile managed by a marketing team stays with the employer. The fiduciary’s authority runs only to accounts and records that belong to the individual personally.
The law also separates the digital account from the underlying property it represents. If someone owns stock through a brokerage app, RUFADAA covers the account interface, but the stock itself is still governed by securities law. A copyright in a digital photograph exists independently of the cloud service storing the file. RUFADAA gets the fiduciary through the digital door; traditional property law still governs what is behind it.
Content Versus Catalog
The single most important distinction in RUFADAA is between the catalog of a user’s electronic communications and the content of those communications. The catalog is metadata: who sent a message, who received it, the date, and the subject line. The content is the actual text, images, or attachments inside.
A fiduciary can generally obtain catalog information with proper documentation. Reaching the content of emails, text messages, or social media direct messages is far more restricted. The fiduciary has to show that the user explicitly authorized content disclosure, either through the platform’s own legacy tool or through specific language in a will, trust, or power of attorney.
This split exists because of federal law. The Stored Communications Act prohibits service providers from voluntarily disclosing the contents of stored electronic communications except under narrow exceptions, including one for lawful consent.1Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records RUFADAA gives state-law fiduciaries a route to establish that consent, but the provider is permitted, not required, to disclose. Without explicit user authorization, a fiduciary may be limited to catalog data and to non-communication assets such as files, photos, and financial records.
Who Can Act as a Fiduciary
Four categories of fiduciary can request access under RUFADAA, each with a different source of authority:
- Personal representatives, meaning executors or administrators appointed by a probate court to administer a deceased person’s estate. Their authority comes from letters testamentary or letters of administration.
- Trustees who manage digital assets held in a trust. Their authority comes from the trust instrument itself.
- Agents under a power of attorney, acting for a living principal. The power of attorney must specifically address digital assets or electronic communications for the agent to request access to them.
- Guardians and conservators appointed by a court for someone who is incapacitated. Their authority comes from the court order, and the court may need to specifically authorize digital asset access after a hearing.
Each of these roles carries real legal exposure. RUFADAA does not create a new liability standard; it extends existing fiduciary duties into the digital context. A fiduciary who mismanages digital property faces the same consequences as one who mismanages tangible property, including breach of duty claims, removal by the court, and personal liability for losses.
The Three-Tier Priority Order
RUFADAA sets a hierarchy that decides who controls access when the will says one thing, the platform setting says another, and the terms of service say something else.
Tier 1: the platform’s own tool. If the service offers an online tool for designating a successor and the user actually configured it, those instructions take priority over everything else. Google’s Inactive Account Manager, Apple’s Legacy Contact, and Facebook’s legacy contact feature are the common examples. The reasoning is that a deliberate action taken inside the platform reflects the user’s most current and informed wishes for that specific account.
Tier 2: the user’s estate planning documents. If no platform tool was configured, the law looks to a will, trust, or power of attorney. The document has to specifically address digital assets or electronic communications. A generic grant of authority over “all property” may not be enough to unlock content, which is why estate planners now routinely add digital-asset language and, where the user wants it, explicit authorization for content disclosure.
Tier 3: the custodian’s terms of service. When neither a platform tool nor a legal document covers the account, the provider’s terms of service control. Most default terms restrict or prohibit post-death access, and some effectively terminate the account on the user’s death. This is the tier people land on when they have done no digital planning, and the outcome is rarely what the family expects.
One consequence of the priority order is that platform settings can quietly override a will. A Facebook legacy contact chosen casually years ago sits above carefully drafted estate documents for that account. The settings deserve the same attention as the will itself.
What the Fiduciary Has to Submit
When a fiduciary contacts a service provider, the custodian will expect a documentation package. The exact requirements vary slightly by fiduciary type, but the core elements are consistent.
For a deceased user’s account, the fiduciary submits a written request for disclosure, a certified copy of the death certificate, and a certified copy of letters testamentary or letters of administration, or a court order granting authority over the decedent’s digital assets. For a guardian seeking access to an incapacitated person’s accounts, the court order establishing the guardianship and authorizing digital asset access replaces the death certificate and letters.
The custodian also needs enough information to locate the account, typically a username, email address, or other unique identifier. If the fiduciary cannot name the account directly, some custodians will accept evidence linking the account to the user, such as billing records.
One detail trips people up. The request should state clearly whether the fiduciary wants the catalog of communications, the content of those communications, other digital assets such as files and photos, or some combination. Asking for everything without that distinction can slow the process, because content disclosure triggers the higher authorization requirements. A fiduciary who only needs financial records and photos should say so and avoid the heavier process reserved for message content.
How the Custodian Responds
Once a provider has a complete, valid request, it has options for how to comply. It might deliver a downloadable copy of the account data, grant the fiduciary limited or temporary login access, or provide a summary of account activity, depending on what was asked for. The law allows a reasonable administrative fee for the retrieval work, though it does not set an amount.
RUFADAA contemplates a 60-day window for custodians to fulfill valid requests after receiving complete documentation. In practice, large providers with dedicated deceased-user teams often move faster, and smaller platforms with no established process often take longer.
If a custodian refuses to cooperate without a valid legal basis, the fiduciary can petition the court for an order compelling disclosure. This judicial backstop exists specifically to prevent digital property from being lost to automated inactive-account deletion. Custodians that comply with a court order or act in good faith under the law’s procedures receive immunity for that disclosure, which removes one of the main reasons providers historically refused.
The Immunity Gap for Fiduciaries
Something that catches many fiduciaries off guard: RUFADAA grants immunity to custodians who disclose in good faith, but it does not extend the same protection to the fiduciary who requested the disclosure. The provider that hands over data under proper procedure is shielded. The fiduciary is not.
That creates a genuine tension. A fiduciary has a duty to manage the decedent’s property, digital assets included, for the benefit of the estate. Failing to pursue valuable digital property can itself be a breach of duty. At the same time, accessing accounts without proper authorization risks liability under federal computer-access and stored-communications statutes. The practical answer is documentation: establish clear legal authority before making any access request, keep records of every step, and limit requests to what the administration actually needs.
Because the law applies existing fiduciary standards, the consequences of mismanagement match those for tangible property. Courts can remove a fiduciary, order damages, or surcharge them for losses caused by negligence. If a fiduciary accesses private communications without authorization and causes harm by, for example, disclosing embarrassing emails, both the estate and third parties whose messages were exposed may have claims.
Where RUFADAA Does Not Reach: Self-Custodied Crypto
Cryptocurrency held on a centralized exchange like Coinbase or Kraken fits the standard model. The exchange is the custodian, and the normal RUFADAA process applies: the fiduciary submits documentation and the exchange can grant access.
Self-custodied cryptocurrency is different. When tokens sit in a personal hardware or software wallet secured by a private key, there is no custodian to petition. The private key is the only means of access, and if it is lost, the assets are gone. No court order can compel a decentralized blockchain to release funds. The law has no mechanism for this situation because there is no third party in the chain. Documenting private keys and recovery phrases, and storing them somewhere a fiduciary can find them, becomes the only workable safeguard. Those details should never go in a will, which becomes a public document in probate.
Planning So the Law Works for You
The most effective way to avoid the problems above is to plan ahead. A digital estate plan does not need special legal instruments. It works within a standard will, trust, or power of attorney, with a few targeted additions.
Start with an inventory. List every account that matters: email, social media, banking, investment platforms, cryptocurrency wallets, subscription services, cloud storage, domain names, online marketplaces, anything with financial or sentimental value. Include the username or email tied to each account. Keep passwords out of the will itself.
Store credentials securely and separately from the inventory. A password manager with an emergency-access or legacy-contact feature is the most practical option. Bitwarden, Keeper, and 1Password each offer a mechanism that lets a designated person request access after a waiting period during which the account holder can deny the request. The analog alternative is a written list in a fireproof safe or with an attorney.
Configure the platform legacy tools. Set up Google’s Inactive Account Manager, Apple’s Legacy Contact, and Facebook’s legacy contact. These settings sit at the top of the priority order and will override conflicting instructions in your estate documents for the accounts they cover, so make sure they reflect current wishes and review them after major life events.
Update the estate planning documents themselves. The will, trust, or power of attorney should explicitly authorize the fiduciary to access digital assets, including the content of electronic communications. Without that specific language, an executor may be limited to catalog data and shut out of the messages themselves. If the digital estate is valuable or sensitive, consider naming a separate digital fiduciary with the technical knowledge to handle it.
Finally, write down what you want done with each account. Some should be preserved, some deleted, some transferred, some memorialized. The fiduciary needs to know not just how to get in but what to do once they are inside.