Digital Estate Planning: What Happens to Your Online Accounts After Death

A modern estate is not just a house, a brokerage account, and a life insurance policy. It is also Gmail inboxes going back twenty years, an iCloud Photo Library with 80,000 images, a 401(k) accessed only through a web portal, a Coinbase wallet holding 2.4 Bitcoin, twelve auto-renewing subscriptions, and a small business that runs entirely through Shopify and Stripe. None of these assets existed when most estate planning doctrine was written, and until 2015 there was no coherent legal framework for what happened to them after death. The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) closed that gap, but the practical planning — inventorying accounts, recording credentials, naming a digital fiduciary — is still something most families never do. This guide covers the legal framework, the platform-specific policies that matter, and the operational steps to ensure your digital estate does not die with you.

What happens to your digital life when you die

Before RUFADAA, the legal status of digital assets after death was a mess. The federal Stored Communications Act (18 U.S.C. § 2701) was interpreted by most providers as prohibiting them from disclosing email contents to anyone — including the executor of the user's estate. The federal Computer Fraud and Abuse Act (18 U.S.C. § 1030) made it a crime to access a computer "without authorization," which providers argued included family members logging into a deceased relative's account even with the password. Terms of service agreements typically prohibited any account sharing.

The result was a Catch-22: executors had a fiduciary duty to marshal estate assets, but the providers refused to grant access. The first attempt, the 2014 Uniform Fiduciary Access to Digital Assets Act (UFADAA), would have granted fiduciaries default access to digital assets on the same terms as physical assets. Provider opposition killed it in most state legislatures.

The compromise was RUFADAA (2015), which reversed the default. Under RUFADAA, fiduciaries do not have default access to email, social media messages, or other "electronic communications" — the principal must opt in by using an "online tool" provided by the custodian (Google Inactive Account Manager, Facebook Legacy Contact, Apple Legacy Contact) or by expressly authorizing disclosure in a will, trust, or power of attorney. For other digital assets (online banking, photo storage, file storage), fiduciaries have default access on the same terms as tangible property.

RUFADAA: the legal framework in 49 states

The Revised Uniform Fiduciary Access to Digital Assets Act was promulgated by the Uniform Law Commission in 2015. As of 2024, every state except Louisiana has adopted some version of RUFADAA, making it the dominant legal framework for digital assets in the United States. Louisiana has its own substantially similar statute (La. R.S. 9:4774) enacted in 2018.

RUFADAA's central innovation is a three-tier hierarchy for determining who controls a digital asset after the user's death or incapacity:

1. Online tool. If the user used the custodian's online tool (Google Inactive Account Manager, Facebook Legacy Contact, Apple Legacy Contact) to designate someone to receive the account or its contents, that designation controls — even if the will says otherwise.
2. Will, trust, or power of attorney. If no online tool was used, the user can authorize disclosure in a will, trust, or POA. The authorization must be specific — RUFADAA § 4 requires "affirmative authorization" for electronic communications and records.
3. Terms of service. If neither an online tool nor an estate planning document addresses the account, the custodian's terms of service agreement controls. This usually means the account is deleted or memorialized, with no access granted to the estate.

The distinction between "electronic communications" (email, text messages, social media DMs) and "other digital assets" (online banking, photo storage, file storage) is crucial. RUFADAA § 4 grants fiduciaries default access to other digital assets, but not to electronic communications — those require explicit opt-in via online tool or estate planning document. The rationale is privacy: a deceased person's email contains third-party communications, and RUFADAA treats those as inheriting some residual privacy interest.

The practical implication: a will that says "I leave all my digital assets to my executor" is not enough to grant access to a Gmail inbox. The will must specifically authorize disclosure of the contents of electronic communications, or the user must have used Google's Inactive Account Manager.

Inventory: listing your digital assets

The first step in any digital estate plan is an inventory. Without it, the executor cannot even identify what assets exist, let alone access them. A useful inventory captures four things for each account: (1) the platform or service name, (2) the username or email associated with the account, (3) the password (or, preferably, a pointer to the password manager entry), and (4) the asset's nature — financial, sentimental, business-critical, or trivial.

Categorize assets by what happens if they are lost:

• Financial assets — bank accounts, brokerage accounts, retirement accounts, PayPal, Venmo, cryptocurrency wallets. These must be located and accessed by the executor; failure means they may escheat to the state after a dormancy period.
• Business-critical assets — domain names, hosting accounts, e-commerce platform logins, social media business pages, ad platform accounts, customer databases. Loss can destroy a business overnight.
• Sentimental assets — photos, videos, email correspondence, personal blogs, social media profiles. The content cannot be replaced, but access can usually be preserved with proper planning.
• Subscription assets — streaming services, software subscriptions, gym memberships, news subscriptions. Without action, these continue to bill the decedent's credit card until the card expires.
• Identity-theft risks — accounts that, if left orphaned, can be hijacked by scammers who target deceased individuals.

The inventory should be stored securely (encrypted, with the executor holding the decryption key or the password) and updated annually. A spreadsheet in a fireproof safe, with a separate document listing the master password, is a reasonable low-tech solution. A shared vault in a password manager with emergency access granted to a trusted person is better.

Email and social media: platform-specific policies

Each major platform has its own post-death policy, and these policies vary substantially. The table below summarizes the major platforms as of 2024:

Google's Inactive Account Manager is the most flexible tool: the user specifies what happens after 3, 6, 12, or 18 months of inactivity, can designate up to 10 trusted contacts to receive account data, and can elect to delete the account entirely. The data the trusted contacts receive is a one-time download — they do not get ongoing access to the account.

Apple's Legacy Contact is the iOS analog. The designated contact receives an access key (which the user must share with them separately) and, after Apple verifies the death certificate, can access iCloud data for three years before the account is deleted. Legacy Contact does not give access to Apple Pay, subscribed content, or Keychain passwords.

Facebook's Legacy Contact can memorialize the page, pin a final post, respond to friend requests, and update the profile picture. They cannot read the decedent's private messages — that content is permanently inaccessible regardless of estate planning.

Online banking and brokerage: custodian rules

Financial accounts are governed less by RUFADAA than by the standard framework for estate assets: the executor presents letters testamentary (or a small estate affidavit) and a death certificate to the institution, and the institution transfers the assets to the estate. What is different about online banking is that the account itself — its login, its multi-factor authentication setup, its linked devices — is the primary access point. Without the credentials, even a court-appointed executor may spend weeks navigating customer service to regain access.

Practical issues with online banking and brokerage:

• Two-factor authentication — if 2FA is set to send codes to the decedent's phone, and the phone's plan is canceled, the executor cannot log in even with the password. Keep a current phone number on file with the executor or maintain backup codes.
• Automatic payments — recurring ACH transfers and credit card auto-pays continue until explicitly stopped. The executor must contact each payee.
• PayPal, Venmo, Cash App — these are not bank accounts and are not governed by the same escheatment rules. Balances can be lost if the account is not addressed within the dormancy period.
• Cloud-based accounting and tax software — QuickBooks Online, TurboTax, Xero accounts may hold the only copies of business records needed to file final tax returns.

For most online financial accounts, the right move is straightforward: ensure the executor knows which institutions hold accounts, and ensure there is a documented path to credentials (typically through a password manager with emergency access). Do not rely on the executor being able to recover access through customer service alone — it can take weeks.

Cryptocurrency: the seed-phrase problem

Cryptocurrency is the asset class where digital estate planning is most critical, because the consequences of failure are absolute. Bitcoin, Ethereum, and other blockchain-based assets are controlled by private cryptographic keys. If the keys are lost, the assets are permanently inaccessible — there is no customer service to call, no password reset, no court order that can recover them. Industry estimates suggest that 3 to 4 million Bitcoin (roughly 17–22% of all Bitcoin ever mined) has been permanently lost, primarily through lost keys and deceased holders.

Two storage models, two different planning problems:

Custodial wallets (Coinbase, Kraken, Gemini, Binance.US) hold the keys on the user's behalf. The user authenticates with a username, password, and 2FA. After death, the executor presents letters testamentary and a death certificate to the exchange, which transfers the assets to the estate. The process is similar to reclaiming a brokerage account. The complications are KYC (know-your-customer) requirements, which can be slow, and 2FA, which can be a barrier if the decedent's phone is unavailable.

Self-custody wallets (hardware wallets like Ledger and Trezor, software wallets like Electrum, Phantom, and MetaMask) hold the keys locally. The user records a seed phrase — typically 12 or 24 words, drawn from the BIP-39 word list — which can reconstruct the private keys. The seed phrase is the asset. If the executor does not have the seed phrase, the cryptocurrency is permanently unrecoverable.

The single most consequential question in crypto estate planning: where is the seed phrase? If it is in a bank safe deposit box that the executor can access, the assets survive. If it is on a sticky note that the executor does not know about, the assets are lost forever. If it is on a sticky note the executor does know about, the assets survive but the security model is compromised.

Best practice for self-custody: store the seed phrase on a metal backup (which survives fire and water), in a secure location accessible to the executor or a designated crypto-savvy fiduciary. Do not store seed phrases in cloud services (iCloud Keychain, Google Drive) in plaintext — a single compromised password exposes the entire wallet. Consider a "shamir's secret sharing" scheme, where the seed phrase is split into multiple shares that must be recombined to reconstruct it.

Photos and cloud storage

For most families, the single most-mourned digital asset after a death is the photo library. iCloud Photo Library, Google Photos, Amazon Photos, and Dropbox typically contain decades of irreplaceable images — and they are usually locked behind credentials that no one else in the family has. The good news is that the major platforms now provide explicit post-death tools:

• Apple iCloud Photo Library — accessible via Legacy Contact for three years after verification of death. The legacy contact receives a download of all photos, notes, files, and messages.
• Google Photos — accessible via Inactive Account Manager, with up to 10 designated recipients who receive a one-time download of all Google data including photos.
• Amazon Photos — Amazon Prime members can designate a "family vault" with up to five members who have access to shared photos; non-shared photos require account access through the executor.
• Dropbox, OneDrive, Box — accessed via the executor with letters testamentary. Dropbox's policy is to release contents to the executor upon receipt of a death certificate and proof of authority; Microsoft's OneDrive requires a court order in many cases.

The critical action is to designate a Legacy Contact (Apple) or set up Inactive Account Manager (Google) while alive. Without these tools, the family will face either an extended process to access photos via the executor or, in some cases, permanent loss if the account is closed before the photos can be downloaded.

For local photo libraries (Lightroom catalogs, RAW files on external drives), the planning question is different: the assets are on physical media, and the issue is whether the executor knows where the media is and how to access it. Encrypted external drives must have their passwords recorded, and a backup strategy (offsite, cloud, local) ensures a single hardware failure does not destroy the entire library.

Subscriptions and recurring billing

A surprising source of post-death friction is recurring billing. Streaming services (Netflix, Spotify, Apple Music), software subscriptions (Adobe Creative Cloud, Microsoft 365), news subscriptions, gym memberships, meal delivery, wine clubs, mobile apps with auto-renewing in-app purchases, cloud storage subscriptions, and domain name renewals continue to bill the decedent's credit card until the card expires or the subscription is explicitly canceled.

The executor's task is to identify and cancel every subscription. Without an inventory, this is a multi-week detective project. Common problems:

• Annual subscriptions billed once a year are easy to miss in monthly statement review. A $200 annual subscription that renews three months after death may go unnoticed until the following year.
• App store subscriptions (Apple App Store, Google Play) are managed through the platform, not directly with the vendor. Canceling requires access to the Apple ID or Google account.
• Domain name renewals are particularly consequential. If a decedent owned a personal domain, the registration must be renewed annually. If it lapses, the domain is acquired by squatters within days and is essentially unrecoverable without paying a substantial ransom.
• Business-critical subscriptions — Shopify, Stripe, AWS, domain hosting — must be transferred to a successor or carefully wound down. Letting AWS or Shopify lapse can take a business offline within hours.

The most efficient prevention is a single recurring annual review of all subscriptions, with the list stored alongside the digital asset inventory. The executor can then systematically cancel each one. Many banks and credit card companies now offer subscription-tracking features that surface recurring charges automatically — useful both for the principal's budgeting and for the executor's post-death review.

Password managers and emergency access

The single most useful tool in digital estate planning is a password manager with an emergency access feature. A password manager stores all credentials in an encrypted vault, accessible through a single master password. The major password managers — 1Password, Bitwarden, LastPass, Dashlane, Keeper — all support some form of emergency access that designates a trusted person who can request access to the vault. If the account holder does not respond to the request within a specified waiting period (typically 7–30 days), the trusted person is granted access automatically.

This solves several problems at once:

• The credentials are stored in a single secure location rather than scattered across browsers, sticky notes, and password files.
• The master password is the only credential the executor needs to learn — and even that can be replaced by the emergency access procedure if the executor does not have it.
• The waiting period prevents abuse while the account holder is alive — a trusted person who requests access prematurely can be denied by the account holder.

Practical guidance:

• Choose a password manager that supports emergency access. 1Password's "Recovery" feature and Bitwarden's "Emergency Access" are the most flexible. LastPass, after its 2022 breach, has lost trust among many security professionals.
• Designate at least two emergency contacts — a primary and a backup, in case the primary is unavailable.
• Set the waiting period thoughtfully. 7 days is reasonable for emergencies; 30 days is safer against premature requests.
• Store the master password separately — in a sealed envelope in a fireproof safe, with the executor's copy of the will. The master password is the single point of failure for the entire vault.

Apple, Google, and Facebook: setting up the tools

The three most important platform-specific tools — Apple Legacy Contact, Google Inactive Account Manager, and Facebook Legacy Contact — are free and take 10–15 minutes each to set up. Setting them up is the single highest-leverage action in digital estate planning.

Apple Legacy Contact (iOS 15.2+): open Settings → tap your name → Password & Security → Legacy Contact. Add up to five contacts. Each contact receives an access key (which you must share with them — Apple does not notify them automatically). After Apple verifies the death certificate, the contact can access iCloud data for three years.

Google Inactive Account Manager: visit myaccount.google.com/inactive. Set the inactivity period (3, 6, 12, or 18 months), designate up to 10 trusted contacts (each of whom can be given access to specific Google data or all data), optionally set an auto-reply message, and choose whether to delete the account after the trusted contacts have downloaded the data.

Facebook Legacy Contact: open Settings → Memorialization Settings → choose a friend. The legacy contact can write a pinned post, respond to new friend requests, and update the profile picture. They cannot read private messages or post as the deceased.

Setting up all three takes less than an hour and protects the three largest repositories of personal digital content for most Americans. The executor's job is dramatically easier when these tools are in place: instead of submitting a death certificate and waiting weeks for provider review, the legacy contact can access the data immediately upon verification of death.

Worked example: a $250,000 crypto estate with no records

Consider a 58-year-old man who dies suddenly. His family knows he was "into Bitcoin" but has no idea how much he owned, where he stored it, or how to access it. He had no will, no digital asset inventory, no Legacy Contact designations, and no password manager. After his death, his adult daughter finds on his laptop:

• A bookmarked Coinbase login page.
• An installed Ledger hardware wallet app, but no Ledger device in the apartment.
• A printed BIP-39 word list taped to the bottom of a desk drawer, with 12 of the 24 words legible (the other 12 water-damaged beyond recognition).
• A text file on the desktop titled "passwords.txt" containing roughly 80 credentials in plaintext, including Coinbase, Gmail, and iCloud.

The daughter hires a crypto-focused estate attorney at $450/hour. The Coinbase account is recovered through letters testamentary and a death certificate, revealing a balance of $78,000 in Bitcoin and Ethereum — easily transferred to the estate. The Ledger device is eventually found in a storage unit six months later, but the seed phrase in the desk drawer is unusable (only 12 of 24 words), and the Ledger's PIN is unknown. The wallet balance, later reconstructed from the device's recovery seed backup, is $172,000 in various cryptocurrencies — recoverable only because the device was found.

If the Ledger had not been found, the $172,000 would have been permanently lost. If the seed phrase had been stored in metal, the wallet could have been recovered in days rather than months. If the daughter had been a designated emergency contact in a password manager, she could have accessed everything within hours.

Total cost: $14,000 in attorney and forensic fees, six months of delay, and substantial emotional toll. The $250,000 estate was preserved only by luck (finding the Ledger) and the daughter's persistence. A password manager with emergency access, a metal seed phrase backup, and a one-page inventory would have reduced the cost to roughly $1,000 in administration fees and a few weeks of delay.

Takeaways

Digital estate planning is no longer optional. Most American adults hold meaningful assets or content in online accounts that their executors cannot access without affirmative planning. The legal framework (RUFADAA, adopted in 49 states) provides the path, but the practical planning falls on the individual: a digital asset inventory, a password manager with emergency access, platform-specific legacy contact designations (Apple, Google, Facebook), a documented crypto seed phrase backup, and explicit authorization in the will or POA for fiduciary access to electronic communications. The cost of getting this right is a few hours of setup and an annual review; the cost of getting it wrong ranges from months of administrative friction to permanent loss of irreplaceable assets. For anyone holding cryptocurrency in self-custody, the question is binary: either the executor can recover the seed phrase, or the assets are gone forever.