Toolkit · Wills and Estates

The Digital Estate and Online Account Toolkit

18 U.S.C. § 2701

Type
Toolkit
Jurisdiction
National
Date
2023-10-25
Topic
Wills and Estates

This toolkit maps the digital estate end to end for individuals, fiduciaries, and counsel, connecting each question to the governing authority and the deeper resource that works it. It opens with the three-tier hierarchy that decides every access question and the counterintuitive fact that a platform's own online tool outranks a professionally drafted will. It then covers the federal privacy statute that causes custodians to refuse, the catalogue-versus-content distinction that determines what a fiduciary gets by default, and the documentation custodians require. A taxonomy section sorts digital assets into licences, owned files, self-custodied value, and administrative records, each of which behaves differently and requires a different response. Separate sections address cryptocurrency, where legal authority is irrelevant to self-custodied holdings; the operational obstacles of two-factor authentication, devices, and phone numbers; the criminal and contractual exposure created by using a decedent's password; and the parallel problem during incapacity. Closing sections supply drafting provisions, a custodian request protocol, an inventory template, a consolidated authorities table, and a ranked failure-mode catalogue.

The Digital Estate and Online Account Toolkit

Wills and Estates > Digital Assets | Published 25 October 2023 - Updated 13 October 2024 | UpLaw - uplaw.us

A checkbox in a settings page outranks a professionally drafted will. Once that is understood, the rest of this field is procedure.

Keywords: three-tier hierarchy, Stored Communications Act, catalogue versus content, online tools, private keys, devices, inventory

How to read this toolkit

Section 1 is the hierarchy. Section 2 is the federal obstacle. Section 3 is RUFADAA. Section 4 is the taxonomy. Section 5 is cryptocurrency. Section 6 is the operational layer. Section 7 is exposure. Section 8 is incapacity. Sections 9–13 are drafting, requests, inventory, authorities, and failure modes.

Companions: Who Gets the Password? Digital Assets, Online Accounts, and the Estate You Left in the Cloud; Digital Assets in Estate Planning and Administration: A Comprehensive Guide to RUFADAA and Beyond; Inventorying and Transferring Digital Assets After Death: A Practical Checklist.

Section 1 — The hierarchy

Tier Source Effect
1 The platform's online tool — legacy contact, inactive account manager Controls, overriding a contrary will, trust, or power
2 Direction in a will, trust, power of attorney, or other record Controls absent a tool direction
3 Terms of service Governs absent both; default limits the fiduciary to catalogue

Check Tier 1 first, every time. A decedent whose will grants full digital access and whose inactive-account setting directs deletion has instructed the platform to delete.

Section 2 — Why custodians refuse

18 U.S.C. § 2701 prohibits a provider from knowingly divulging the contents of a stored communication, subject to exceptions including disclosure with the lawful consent of the originator or an addressee. Definitions and interception provisions are at 18 U.S.C. § 2510.

The statute contains no exception for death or fiduciaries. A custodian asked to disclose without consent faces genuine exposure and refuses. The contract layer compounds it: accounts are non-transferable, terminate on death, and grant personal licences.

Section 3 — RUFADAA

What it does. Supplies the consent the federal statute requires; distinguishes catalogue (that a communication occurred) from content (what it said); establishes the hierarchy; and confers authority on executors, trustees, agents, and conservators with different defaults for each.

Defaults. Executors and trustees generally get catalogue without express authority and content only with it. Agents under a power of attorney require express authority for content in every enactment and, in several, for catalogue as well.

Custodian documentation. A written request; certified death certificate; certified letters or instrument; account identifier; linking evidence; and, for content, express consent through a tool or instrument or a court order finding consent or that disclosure is reasonably necessary for administration. Custodians may charge a fee, decline to restore deleted assets, and require an order where a request is unduly burdensome. Compliance is typically due within about sixty days.

Section 4 — Taxonomy

Category Legal character Response
Licences — streaming, media libraries, software, loyalty Non-transferable contract rights Cancel; check program transfer policies; manage expectations
Owned files — photos, documents, code, manuscripts Property; copyright under 17 U.S.C. § 201 and rights under 17 U.S.C. § 106 Independent backups during life
Self-custodied value — private keys Property; unreachable without the key Tested recovery mechanism
Administrative records — email, cloud, portals The index to the estate Plan access; this is the priority

Domains are registrar contract rights, transferable through the registrar's process — and they expire. Calendar renewal on day one; a lapsed domain is gone and immediately re-registrable.

Loyalty programs frequently permit transfer on request despite terms suggesting otherwise. Ask.

Section 5 — Cryptocurrency

Custodial holdings at an exchange are reached through the exchange's estate process, like a brokerage account; exchanges fall within financial-institution definitions at 31 U.S.C. § 5312. Valuation is at date of death under 26 U.S.C. § 2031.

Self-custodied holdings are the one asset class where the fiduciary's legal authority is irrelevant. No order moves a blockchain; a lost key is a permanently lost asset.

Workable recovery designs: a sealed seed phrase in a safe deposit box with documented access authority; a multi-signature arrangement including a fiduciary or trusted third party; a custodial arrangement accepting counterparty risk; a specialized inheritance service with a tested trigger.

Not workable: a seed phrase in a will (a public record), a memorized phrase, or an untested plan.

Context: How Cryptocurrency Is Regulated Around the World: A Comparative Overview.

Section 6 — The operational layer

Legal authority plus consent plus a password can still fail at the second factor.

  • Keep the mobile number active at least six months — it is the recovery channel for nearly everything.
  • Preserve devices; never reset them. Authenticator apps and saved credentials die with a factory reset.
  • Find the backup codes, printed at two-factor setup and filed with the passport.
  • Check the password manager for a designated emergency contact and start the recovery waiting period early.
  • Stop inactive-account timers, which can delete material while a request is pending.
  • Preserve before deleting, always, to two independent locations.

Section 7 — Exposure from using the decedent's password

Source Risk
18 U.S.C. § 1030 Unauthorized access; narrowed but not eliminated by Van Buren
18 U.S.C. § 2701 Civil and, in circumstances, criminal exposure
18 U.S.C. § 2510 Interception of live communications
Terms of service Independent contract breach

The authorization analysis for publicly available data is discussed in hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019); the broader collision is treated in Web Scraping and the Law After hiQ v. LinkedIn.

Where it actually bites: family conflict; business accounts, where the company is the injured party; and access used to move money, which becomes an ordinary fraud case.

Section 8 — Incapacity

The identical obstacle appears sooner and more often during life, and RUFADAA's default for an agent is narrower than for an executor.

The sentence that solves it, in every durable power, will, and trust:

"My agent is authorized to access, use, control, and manage my digital assets and electronic communications, including the content of electronic communications, and this constitutes my lawful consent under 18 U.S.C. § 2701 and my direction under the [State] Revised Uniform Fiduciary Access to Digital Assets Act."

And set the online tools, because Tier 1 beats Tier 2. See Powers of Attorney and Advance Directives: A Comprehensive Guide to Planning for Incapacity and The Incapacity Planning and Surrogate Decision-Making Toolkit.

Section 9 — Drafting

Will and trust: a digital-assets article authorizing access to content, reciting lawful consent under the federal statute and direction under the state act, and instructing the fiduciary to check for online-tool directions.

Power of attorney: the parallel provision, expressly covering content.

Ask the online-tool question at the planning meeting. Most clients have set nothing; a few have set something inconsistent with the plan, and only asking reveals it.

Consider a digital fiduciary — the best financial executor is frequently not the best person to navigate platform processes and recover devices.

Address self-custodied crypto directly, and address deletion preferences, since RUFADAA honors a direction to delete and some clients want correspondence destroyed rather than read.

Section 10 — The request protocol

  1. Use the platform's dedicated deceased-user process, not general support.
  2. Supply certified death certificate, certified letters or instrument, fiduciary identification, account identifier, linking evidence.
  3. Cite the state RUFADAA section, and specify catalogue or content.
  4. For content, state the basis — tool direction, quoted instrument provision with the instrument attached, or a request that the custodian identify what it requires.
  5. Ask the closed question: "Would an order in the attached form satisfy your requirements?"
  6. Diary the compliance period; escalate in writing to the legal or records team.
  7. Where an order is needed, petition with specific necessity — quantified receivables, unlocatable assets — not a conclusory request for "access to the email."
  8. Deliver the entered order promptly and request an archive where offered.

Section 11 — The inventory

Include: accounts by category (email, cloud, financial, business, social, subscription, domains, crypto); provider and login identifier; whether an online tool is set and to what; mobile carrier and account; devices and unlock method; location of two-factor backup codes; domain renewal dates; and a short statement of wishes.

Exclude: passwords. A will is a public record and an inventory circulated to family is a security document.

Store credentials separately: a password manager with a tested emergency-access feature; a sealed record in a safe deposit box with documented access authority; or a written record held by counsel with delivery instructions.

Update annually, alongside the beneficiary-designation review.

Section 12 — Authorities at a glance

Authority What it supplies
18 U.S.C. § 2701 · § 2510 Stored Communications Act
18 U.S.C. § 1030 Computer Fraud and Abuse Act
hiQ Labs, Inc. v. LinkedIn Corp. Authorization analysis
17 U.S.C. § 201 · § 106 · § 101 Copyright as an estate asset
26 U.S.C. § 2031 Date-of-death valuation
31 U.S.C. § 5312 Exchanges as financial institutions
15 U.S.C. § 1681b · § 1681i Consumer reports; deceased alerts and disputes
45 C.F.R. part 164 Health information in patient portals
15 U.S.C. § 7001 · § 7003 Electronic records; excluded instruments

The state sources that matter more: the state's RUFADAA enactment and the probate code's fiduciary powers. And the non-legal sources that matter most: each platform's deceased-user policy and online tools, which sit at Tier 1.

Section 13 — Failure modes, ranked

  1. Cancelling the mobile number in the first month.
  2. Resetting a device.
  3. Missing an inactive-account timer.
  4. Logging in with the decedent's password.
  5. No online-tool direction, so content requires a court order.
  6. A tool direction inconsistent with the estate plan, silently overriding it.
  7. No digital-asset authorization in the will, trust, or power.
  8. Submitting to general support rather than the deceased-user process.
  9. A conclusory petition, denied for want of specific necessity.
  10. Deleting before preserving.
  11. A self-custodied wallet with no tested recovery mechanism.
  12. Letting a domain lapse.
  13. Skipping the deceased alert with the credit bureaus.
  14. An inventory three years stale.

Section 14 — Six accounts, six answers

Email. The index to a paperless estate and the hardest to reach. Catalogue by default; content requires Tier 1, Tier 2, or a court order. Plan for this one specifically, and where a petition is needed, quantify the necessity — a request supported by "$14,000 in receivables recorded nowhere else" is granted; "access to the decedent's email" is not.

Photo library. Owned files in an unreachable account. Legacy-contact tools frequently release an archive, which is why setting them is the highest-return twenty minutes in the field. The independent fix is a backup the family can physically reach.

Digital media library. A non-transferable licence that terminates. A will cannot bequeath it, and family expectations to the contrary are near-universal.

Social accounts. Memorialization or deletion on a death certificate; private messages are content. For most families the account is not the point — the photographs and posts are, and an archive request usually gets them.

Cryptocurrency. Custodial: an ordinary financial-institution process. Self-custodied: legal authority is irrelevant, and a lost key is a permanently lost asset.

Business accounts. Where an entity owns the account, its documents and successor manager control. Where the decedent was a sole proprietor in her own name, the distinction collapses and personal rules govern — the trap for precisely the people whose livelihood depended on the account. See Running Multiple Businesses Under One Structure: A Deep Dive into Holding, Operating, and Parent Companies and The Small Business Legal Toolkit.

Section 15 — Triage: what to do first

Economic value — crypto, domains with resale value, monetized accounts, code, manuscripts, photograph catalogues. Ordinary estate assets: value, inventory, collect.

Administrative value — email, cloud, portals, password manager. Rarely worth anything alone; frequently the only route to everything else.

Sentimental value — photographs, messages, recordings. Legally simplest and, for most families, the entire point. Also the most likely to be destroyed by a timer while everyone attends to the money.

Privacy value — what the decedent wanted not disclosed. RUFADAA honors a deletion direction over a contrary will provision, which is a feature and deserves a sentence in the planning conversation.

The priority for a fiduciary with limited time and money: secure the administrative accounts first, because they identify everything else; preserve the sentimental material next, because it is on a clock; pursue the economic assets on the ordinary timetable, because they are not going anywhere.

Section 16 — Adjacent problems the same planning solves

Identity theft after death. A decedent's identity is attractive because nobody is monitoring it. Request a deceased alert with the credit bureaus; notify the Social Security Administration and any paying agency; close or freeze accounts; monitor for new ones. Access rules at 15 U.S.C. § 1681b; disputes at 15 U.S.C. § 1681i.

Health records. Patient portals are governed by 45 C.F.R. part 164 rather than RUFADAA. A personal representative is generally entitled to access, but a freestanding HIPAA authorization executed during life is faster and avoids the argument. See HIPAA Compliance: A Practical Checklist.

Business continuity. For a sole proprietor, the digital accounts are the business. A succession plan addressing ownership but not access leaves the successor with an entity and no way to operate it.

Surviving data obligations. A decedent who ran a website or application may have held other people's personal data subject to state privacy statutes and customer contracts. Those obligations pass to whoever controls the entity or estate, and shutting a service down without addressing deletion and notification can create liability. See Data Privacy Compliance: A Comprehensive Guide to State Privacy Laws and Consumer Rights and Building a Privacy Compliance Program: A Practical Checklist.

Section 17 — A one-page brief for the family

Give this to relatives in the first week; it prevents the irreversible mistakes.

Do not cancel the phone. It is the key to almost every account. Six months minimum.

Do not reset or wipe any device, and do not return a leased phone to the carrier.

Do not delete anything, including accounts that seem trivial — some hold the only copy of something.

Do not log in as the deceased person. Use each company's deceased-user process. Slower, and it avoids a real legal problem.

Do gather printed passwords, backup codes, hardware wallets, and written notes, and give them to the executor.

Do tell the executor about accounts you know of. The executor cannot request what they do not know exists.

Do be patient. Platform requests take weeks to months and a court order takes longer. Nothing is lost by the delay so long as the first four instructions are followed.

Section 18 — A closing observation

For most of the twentieth century a person's important records were objects in their house, and an executor who had the house had the estate. Today they are access rights against companies, governed by contracts of adhesion and a privacy statute drafted when a modem was an exotic accessory.

The law has adapted reasonably well. RUFADAA identifies the real obstacle, supplies the consent the federal statute demands, respects the user's own choices in a sensible order, and gives fiduciaries a workable path.

Practice has not. Estate plans still speak of tangible property and financial accounts; almost none contain digital-asset authority; almost no client has been asked about legacy contacts; and almost nobody has an inventory.

Three tasks close the gap, in ascending order of value and descending order of effort. Add the authorization language — a paragraph. Set the online tools — twenty minutes, and they outrank the paragraph. Make the inventory — an afternoon, no lawyer required, and in a paperless household the difference between an executor who can administer the estate and one who cannot find it.

Section 19 — Where the law is going

Three developments, offered with appropriate uncertainty.

Platform practice is converging faster than legislation. The major providers now offer broadly similar deceased-user processes and legacy tools, and that convergence does more practical good than any statutory amendment — because Tier 1 controls, and a well-designed tool resolves the question before a fiduciary ever writes to anyone.

The Stored Communications Act remains unamended for this purpose. Proposals to add a fiduciary exception have not advanced, and RUFADAA's workaround — supplying consent rather than creating an exception — is elegant but leaves a 1986 statute governing estates of people who die in 2026.

Self-custodied digital assets are producing a class of permanent, uninsurable loss with no legal remedy. Estimates of unrecoverable cryptocurrency vary enormously and deserve skepticism, but the direction is not in doubt, and it is the only asset class where the entire apparatus of succession law is simply inapplicable. Multi-signature and social-recovery arrangements are the technical answer; whether they are adopted widely enough to matter is genuinely open.

A modest prediction. The practical bottleneck in this field will remain the inventory, not the law. RUFADAA works, platform processes work, and courts issue the orders. What fails repeatedly is that nobody knows which accounts existed — and no statute can fix that. The remedy is an afternoon's work by the account holder, and the profession's contribution is mostly to ask the question at the planning meeting.

One further note for practitioners. The same analysis is beginning to appear in contexts beyond death and incapacity: dissolution of marriage, where jointly used accounts must be separated; departure of a business partner, where personal accounts hold company data; and the wind-down of a small enterprise, where obligations to customers survive the entity. The vocabulary developed here — catalogue versus content, custodian consent, tiered authority — transfers cleanly, and a lawyer comfortable with RUFADAA will find the adjacent problems easier than they look. See Divorce: A Comprehensive Guide to Dissolution, Property Division, Support, and Custody and The Commercial Contracts Toolkit: Drafting, Reviewing, and Enforcing Business Agreements.

Related Documents

Articles

Guides

Checklists

Toolkits