RUFADAA, the Revised Uniform Fiduciary Access to Digital Assets Act, gives four kinds of fiduciaries — executors, agents under a power of attorney, trustees, and court-appointed guardians or conservators — a legal route to request a person’s online accounts and digital files from the company that holds them. Fiduciary access to digital assets under RUFADAA runs through a three-tier priority system that decides whose instructions control, a documentation checklist that varies based on what you’re asking for, and a 60-day clock the service provider has to answer. The act was developed by the Uniform Law Commission and has been enacted in most states.
What a Digital Asset Is Under the Act
RUFADAA defines a digital asset as any electronic record in which a person has a right or interest, excluding any underlying asset or liability unless that asset or liability is itself an electronic record.1Kentucky Legislative Research Commission. Revised Uniform Fiduciary Access to Digital Assets Act (2015) That reaches email accounts, social media profiles, cloud-stored photos and documents, cryptocurrency wallets, loyalty points, domain names, and subscription services with residual value.
The act focuses on the data, not the device. A phone or laptop is tangible property that passes through ordinary probate; the accounts and files on it are the digital assets. A few boundaries are worth knowing before you file anything:
- RUFADAA does not apply to digital assets an employer provides to an employee for work purposes. Keeping personal accounts off employer-issued hardware avoids a messy overlap.
- The act does not transfer intellectual property. If the decedent created copyrighted photographs, music, or writing stored in a cloud account, RUFADAA can get the fiduciary access to the files, but the copyright itself passes through the will or intestate succession.
Content vs. Catalogue
Within electronic communications, the act splits the data in two. The content is the substance of a message — what the person actually wrote in an email, text, or direct message. The catalogue is the metadata: who they communicated with, when, and at what address.1Kentucky Legislative Research Commission. Revised Uniform Fiduciary Access to Digital Assets Act (2015) This split drives most of the friction with tech companies. Catalogue data usually moves with standard documentation. Content requires proof that the user consented to its release or a court order, because federal privacy law protects it more heavily.
Who Can Request Access
RUFADAA authorizes four categories of fiduciaries to request digital assets from a custodian:1Kentucky Legislative Research Commission. Revised Uniform Fiduciary Access to Digital Assets Act (2015)
- Personal representatives, meaning executors or administrators appointed by a probate court to settle the estate of someone who has died.
- Agents under a power of attorney, authorized to manage a living person’s affairs while that person can no longer do so. The power of attorney must have been signed while the principal still had capacity.
- Trustees, acting under a trust document for the benefit of named beneficiaries.
- Conservators or guardians, appointed by a court for someone who has been found unable to handle their own affairs. These appointments usually happen when no power of attorney was set up in time.
Every fiduciary carries the same core duties under the act: care, loyalty, and confidentiality.1Kentucky Legislative Research Commission. Revised Uniform Fiduciary Access to Digital Assets Act (2015) They apply the same way they would to physical property. A fiduciary who reads a decedent’s private messages and shares them with relatives out of curiosity violates the duty of confidentiality just as plainly as one who opens sealed mail. The act also limits the fiduciary to rights the original user held: you cannot do anything with the account the account holder could not have done.
The Three-Tier Priority System
When someone dies or loses capacity, RUFADAA decides whose instructions control the account through a priority system with three tiers. The highest tier wins, and this is where families are most often caught off guard.
Tier One: The Online Tool
The top tier is any direction the user gave through an online tool the service itself provides. If the user named a Legacy Contact on Facebook, set up Google’s Inactive Account Manager, or designated a Digital Legacy contact through Apple, that choice overrides everything else, including a later-dated will that says something different. Service providers prefer these tools because they’re wired into their security systems and show a deliberate choice by the account holder.
The practical consequence is sharp. A setting in an app the person forgot about can decide what happens to that account, even if the will says otherwise. Each platform also defines its own scope. Facebook’s Legacy Contact can write a pinned post on a memorialized profile, respond to friend requests, and update the profile photo, but cannot log in as the deceased user or read private messages.2Meta. Adding a Legacy Contact Apple’s Digital Legacy program requires the designated contact to have both an access key generated when they were added and the account holder’s death certificate before stored data is released.3Apple. Request Access to a Deceased Family Members Apple Account
Tier Two: Legal Documents
If the user left no online tool direction, the act looks to wills, trusts, and powers of attorney. For these to work smoothly, they should name digital assets specifically. A generic clause granting authority over “all my property” may cover digital accounts, but a clause that explicitly names digital assets and authorizes access to the content of electronic communications leaves the custodian far less room to push back. Specificity here saves weeks of delay and often avoids a court filing.
Tier Three: Terms of Service
If the user never used an online tool and never addressed digital assets in a legal document, the custodian’s terms of service control by default. Most terms of service are written to protect the company. They commonly prohibit account transfers, restrict third-party access, and may authorize deletion after a period of inactivity. For a user who did no planning, corporate policy becomes the last word.
Documentation the Custodian Will Expect
What a fiduciary submits depends on their role and whether they’re asking for the catalogue or the actual content of communications.
Standard Submission
Every request should include a written request identifying the account by username, email, or account identifier; a certified copy of the death certificate when the account holder has died; and proof of the fiduciary’s authority. That proof is:
- For an executor: Letters Testamentary or Letters of Administration from the probate court.
- For a conservator or guardian: the court order of appointment.
- For a trustee: the relevant portions of the trust document.
- For an agent: the power of attorney itself.
When You’re Asking for Content
Content triggers a higher bar. The fiduciary must provide either evidence that the user consented to content disclosure — typically a specific clause in the will, trust, or power of attorney — or a court order finding that disclosure is necessary for estate administration and would not violate federal privacy law. Without that second layer, custodians are only required to release catalogue data and non-communication digital assets. This is where vague estate planning costs families the most. A will that says “my executor may access my online accounts” will usually not satisfy a tech company’s legal team on the content question.
Sending the Request and the 60-Day Clock
Most major tech companies run dedicated online portals for requests involving deceased or incapacitated users. Apple, Google, Meta, and Microsoft all do. These portals provide upload forms for legal documents, death certificates, and identification. Where no portal exists, send the request by certified mail to the company’s legal or compliance department so there’s a paper trail.
Once the custodian has received all required documentation, RUFADAA gives it 60 days to comply or deny. If the custodian misses that window, the fiduciary can petition a court for an order compelling compliance.4Rhode Island General Assembly. Rhode Island Code 33-27.1 – Revised Uniform Fiduciary Access to Digital Assets Act – Section 33-27.1-16 In practice, large companies with established portals often respond well within that window; smaller platforms without dedicated systems may need prodding. Custodians may charge a reasonable administrative fee for processing, though RUFADAA does not specify an amount. The custodian also has three options for how it delivers the data: full account access, partial access sufficient for the fiduciary’s duties, or a bulk download of the account’s contents.
Custodians that comply with a RUFADAA request in good faith are shielded from liability for the disclosure, except for willful misconduct. That immunity is part of why the formal process exists; companies that follow it are protected, which gives them less reason to stonewall a legitimate request.
Why You Should Not Just Log In
RUFADAA sits alongside two federal laws that shape what a fiduciary can safely do.
The Stored Communications Act prohibits electronic communication service providers from voluntarily disclosing the content of stored communications except under specific exceptions, including disclosure with the lawful consent of the originator, addressee, or intended recipient, or to an agent of the addressee or intended recipient.5Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records RUFADAA was built to fit within those boundaries. When the user has consented through an online tool or a legal document authorizing content disclosure, that consent satisfies the SCA. Without it, the fiduciary typically needs a court order, and some custodians will demand judicial confirmation that disclosure will not violate federal law before releasing anything.
The Computer Fraud and Abuse Act criminalizes unauthorized access to computers and online accounts. Because most terms of service forbid sharing login credentials, an executor who logs into a deceased person’s account using a saved password may technically violate federal law. The Department of Justice has suggested that prosecution “may not be warranted” when the only violation is a terms-of-service breach, but the Supreme Court has pointed out that “may not be warranted” is not the same as “prohibited.” RUFADAA uses the word “disclosure” rather than “access” for a reason: the safe path is to request information through the custodian’s process, not to log in with the decedent’s credentials, no matter how convenient that would be. The act does not explicitly grant fiduciaries immunity from CFAA prosecution.
Fiduciary Exposure
The duties of care, loyalty, and confidentiality extend fully to digital assets.1Kentucky Legislative Research Commission. Revised Uniform Fiduciary Access to Digital Assets Act (2015) A fiduciary who neglects to collect cryptocurrency owed to the estate, fails to preserve valuable digital files, or shares private information obtained during administration can be removed and held personally liable for the resulting losses. Courts have broad authority to remove a fiduciary for waste, improper management, or conduct showing unfitness for the role.
Tax Reporting on Digital Assets in the Estate
The IRS treats cryptocurrency and other digital assets as property, not currency.6Internal Revenue Service. Notice 2014-21 Capital gains, basis calculations, and fair market value at the date of death all apply. For estate tax purposes, assets like Bitcoin are valued at their fair market value on the date of death, which is straightforward for assets traded on major exchanges but harder for tokens that trade thinly or lack comparable sales.
Fiduciaries filing Form 1041, the estate and trust income tax return, must answer the digital asset question on the return, which asks whether the estate received, sold, exchanged, or otherwise disposed of any digital asset during the tax year.7Internal Revenue Service. Digital Assets If the answer is yes, the transaction must be reported regardless of gain or loss. Capital asset transactions go on Form 8949; ordinary income from activities like staking or mining is reported on Schedule 1. For estates with significant cryptocurrency holdings, a tax professional who understands both the valuation challenges and the reporting rules is worth the fee. Missing an obligation here can delay the entire estate settlement.