What happens to your online accounts when you die depends almost entirely on what you set up beforehand: most platforms freeze or delete accounts once they learn the user has died, federal privacy law blocks providers from handing contents to family by default, and the only reliable way to keep your email, photos, social profiles, and files reachable is to use each service’s legacy tools and leave explicit authority in your estate documents. Do nothing, and the platform’s terms of service govern. Those terms rarely favor your family.
Why Providers Won’t Just Hand Things Over
The core legal barrier is the Stored Communications Act, a 1986 federal law that prohibits electronic communication services from voluntarily disclosing the contents of stored communications to outside parties. It allows disclosure with the lawful consent of the originator, addressee, or intended recipient, but a dead person cannot consent, and courts have not uniformly agreed that an executor inherits that right.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records This is the provision tech companies cite when they refuse to release a deceased user’s emails or private messages, even when the person asking has valid Letters Testamentary.
Who Legally Controls Your Account
Nearly every state has adopted some version of the Revised Uniform Fiduciary Access to Digital Assets Act, known as RUFADAA. It sets a strict priority order for determining who controls your digital property after death.
- Platform-specific tools come first. If you configured Google’s Inactive Account Manager, a Facebook Legacy Contact, or an Apple Legacy Contact, those choices override everything else because you made them on the service itself.
- Estate planning documents come second. Explicit language in your will, trust, or power of attorney granting your executor authority over digital assets takes effect when no platform tool was used.
- Terms of service come last. If you left no instructions at all, the platform’s terms govern, and those terms almost universally say accounts are non-transferable and may be terminated upon death.
The implication is simple. Silence hands the decision to the platform. A single clause in your will changes the legal footing, and five minutes inside a platform’s settings carries more weight than that clause.
What to Set Up While You’re Alive
Make a Written Inventory
Write down every account that matters: email, social media, cloud storage, banking, investment platforms, subscription services, domain names, and anything that generates revenue. For each, note the service, your username, and the associated email address. Do not include passwords in this document. Instead, point to where they can be found, such as a password manager or a sealed envelope held by your attorney.
Use Each Platform’s Legacy Tool
Several major services offer tools built for exactly this situation, and under RUFADAA they carry the most legal force.
Google’s Inactive Account Manager lets you designate up to ten trusted contacts who can receive specified types of account data if your account goes inactive for a period you choose.2Google Help. About Inactive Account Manager Facebook lets you appoint one person from your friends list as a Legacy Contact; that person can write a pinned post on your memorialized profile, update your profile photo, and respond to new friend requests.3Facebook Help Center. Legacy Contacts Apple lets you name one or more Legacy Contacts for your Apple Account; the system generates a unique access key your contact will need, along with your death certificate, to request your photos, messages, and other data.4Apple. How to Add a Legacy Contact for Your Apple Account
Turn On Password Manager Emergency Access
Password managers can hold hundreds of logins behind one point of access, and several now include emergency access features built for death or incapacitation. NordPass lets you invite trusted contacts who can request access at any time; if you don’t deny the request within seven days, the vault unlocks for them in read-only mode. Proton Pass offers a similar feature with a configurable wait of up to thirty days. 1Password’s zero-knowledge architecture means the company itself cannot decrypt your vault, so it provides a downloadable Emergency Kit, a PDF containing your login credentials and secret key with a space to write in your master password; whoever holds that kit gets full access.
The step most people skip is telling the emergency contact that the feature exists and explaining what to do with it. A feature nobody knows about is useless.
Add Specific Digital-Asset Language to Your Will or Trust
Your estate planning documents should explicitly grant your executor authority to access, manage, and distribute your digital assets. Generic “all property” language may not be enough; courts and tech companies look for specific references to digital accounts. Under RUFADAA, a clear directive can override restrictive terms of service, which matters most for platforms without legacy tools of their own.
Wills typically become public records in probate, so never include passwords, private keys, or security credentials in one. Reference where they live instead, such as a sealed envelope held by your attorney or a password manager with emergency access already granted.
Plan Around Two-Factor Authentication
Even an executor with every legal document can be stopped by two-factor authentication. Text-message codes require the deceased’s phone number and an unlocked device. Authenticator apps are bound to a specific device and generally cannot be transferred. Biometric authentication is, by definition, impossible for anyone else to use. Physical security keys are small, easily overlooked, and their existence often unknown to family.
The fix is prevention. Make sure your executor knows the unlock code for your phone, and store backup codes for critical accounts alongside your password manager credentials. A locked phone is often the single point of failure in the whole process.
If You Did Nothing: The Executor’s Path
When someone dies without any digital estate planning, the executor faces a company-by-company grind. The first step is paperwork: a certified death certificate and a court-issued document proving authority over the estate, usually Letters Testamentary if there is a will or Letters of Administration if there isn’t. Both come from a probate court; filing fees vary by jurisdiction.
With documents in hand, the executor contacts each company individually. Most large platforms have help pages for deceased-user requests, usually found by searching the company’s help center for “deceased” or “memorialization.” Expect weeks per request, and sometimes multiple rounds of documentation.
Outcomes vary. Social media accounts can usually be memorialized or deleted. Some companies offer data downloads of photos or files. Access to private communications is the hardest to obtain, because of the Stored Communications Act, and many companies will not grant it without a court order that specifically addresses federal privacy law.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records Some providers require the order to include language confirming disclosure “would not violate any applicable laws, including but not limited to the Electronic Communications Privacy Act,” which means your attorney may need to draft that language for the judge.
Don’t Just Log In With a Found Password
Logging into a deceased relative’s account with a password you discovered seems easier, but it can create federal exposure. The Computer Fraud and Abuse Act makes intentionally accessing a computer “without authorization” a federal crime, carrying up to one year in prison for a first offense and up to five years if the information obtained is worth more than $5,000.5Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers The Supreme Court held in Van Buren v. United States (2021) that knowing a password doesn’t mean you’re authorized to use it. Unless the account holder granted you access through an estate document or a platform tool, logging in with their credentials sits in a legal gray area at best.
How Major Platforms Handle a Death
If the deceased appointed a Legacy Contact, that person can manage the memorialized profile: write a pinned tribute post, update the profile picture and cover photo, and respond to new friend requests. The Legacy Contact must be a Facebook friend and can only be one person.3Facebook Help Center. Legacy Contacts If none was set, a family member can request memorialization or permanent deletion.
Instagram, also owned by Meta, allows accounts to be memorialized at a family member’s request. Memorialized profiles with a legacy contact can be managed; those without one cannot be changed. Family members can also request permanent deletion.6Instagram Help Center. About Memorialized Instagram Profiles
If the deceased set up Inactive Account Manager, their designated contacts, up to ten, are notified and given access to the data types the account holder specified after the chosen inactivity period passes. Without that setup, Google will permanently delete an account and all its data after two years of inactivity.2Google Help. About Inactive Account Manager Family members can submit a request to close the account or obtain specific data, but Google evaluates each request individually and approval is not guaranteed.
Apple
Apple’s Legacy Contact feature generates a unique access key during setup. After death, the designated contact submits that key along with a death certificate. Once approved, the contact receives a special account to access the deceased’s data for up to three years, after which everything is permanently deleted. Without a Legacy Contact, Apple requires a court order specifically naming the applicant as the rightful inheritor of the deceased’s personal information, one of the stricter policies among major tech companies.4Apple. How to Add a Legacy Contact for Your Apple Account
X (Formerly Twitter)
X has the most restrictive approach among major platforms. There is no memorialization option, no legacy contact feature, and the terms of service contain no provisions for death or estate succession. The only option is permanent deactivation. Family or estate representatives can submit a deactivation request, but X will not grant account access, provide data downloads, or preserve content.
Anyone can report a member as deceased, which triggers memorialization. If you have legal authority over the estate, you can request full account closure by providing the member’s death certificate along with Letters of Administration, Letters Testamentary, or another court order proving your appointment.7LinkedIn Help. Deceased LinkedIn Member
Yahoo Mail
Yahoo’s terms say the company will terminate an account and delete its data when the owner dies. There is no legacy contact or memorialization feature. If no one logs in for twelve months, Yahoo deletes the account automatically. An executor who wants it terminated sooner must send a written request along with proof of authority and a copy of the death certificate.
Microsoft
Microsoft generally requires a valid court order to release account content from services like Outlook.com and OneDrive. Without proactive planning, accessing a deceased person’s Microsoft data requires probate court involvement and potentially a court order addressing federal privacy law.
Cryptocurrency Needs Its Own Plan
Crypto is the most dangerous category to leave unplanned. By some estimates, roughly 20% of all Bitcoin is permanently lost because owners died or lost access to their private keys. A wallet secured by a private key has no back door. If the key is gone, the funds are gone.
For crypto held on an exchange like Coinbase, the process resembles other financial accounts. Coinbase requires a death certificate, probate documents such as Letters Testamentary, a government-issued photo ID of the executor, and a signed letter instructing the transfer, handled through its Executor Services process. Coinbase does not currently support naming a beneficiary directly on individual accounts, so estate planning documents or state intestacy law dictate who inherits.8Coinbase Help. Claim a Decedent’s Coinbase Account
For crypto in a personal wallet, whether software or a hardware device like a Ledger or Trezor, no company can help. Your heirs can access those funds only if they have the private key or the recovery seed phrase, typically twelve or twenty-four words generated when the wallet was created. Store that information in a locked safe or sealed envelope held by an attorney, and tell your executor where it is. Never put a seed phrase in your will. Consider splitting the pieces: hardware wallet in one location, recovery phrase in another, with your executor knowing about both.
Stop the Charges That Keep Running
Recurring subscriptions quietly drain estates for months. Streaming services, software, cloud storage, gym memberships, and app purchases keep billing until someone intervenes.
Review the deceased’s bank and credit card statements for recurring charges, starting with monthly ones because they accumulate fastest. If you have login access, cancel through the account settings. If not, contact customer service with the account holder’s email, a death certificate, and proof of your estate authority. Many companies have specific bereavement processes, though you may need to ask directly since they aren’t always advertised. You can also notify the deceased’s bank or credit card issuer to close the card to future charges; the estate still owes any outstanding balance, but new subscription charges stop. Some services issue prorated refunds for deceased account holders when provided a death certificate.
Guard Against Identity Theft
Deceased individuals are frequent targets of identity theft because the fraud can go undetected for months or years. Personal information, Social Security numbers, and financial data stored in digital accounts raise the risk.
One of the first steps an executor should take is notifying one of the three major credit bureaus, Experian, TransUnion, or Equifax, of the death with the deceased’s name, Social Security number, date of birth, date of death, and a copy of the death certificate. Notifying one is usually enough because they share death notifications with each other. After notification, request a credit freeze on the deceased’s file to block new accounts opened in their name.
The Social Security Administration maintains a Death Master File that banks, federal agencies, and identity verification companies rely on to flag deceased individuals.9Social Security Advisory Board. Social Security and the Death Master File There is often a delay before a death propagates, and identity thieves operate in that window. Promptly notifying credit bureaus and monitoring the deceased’s credit report for several months after death closes most of that gap.