When a loved one dies, who downloads their important files from their cloud storage account? Who monitors their email inbox? Who decides what happens to the photos and videos on their social media accounts? And what if those tasks fall to you?
Everyone will die, but not everyone has planned what they want to happen with their digital assets after they’re gone. Even when someone makes a plan, survivors might still be limited in what they can do.
Tying up loose ends can become a nightmare for the living, especially when the volume of digital assets is enormous. Still, the more you know, the better you can plan for your own digital estate, and the easier it will be to manage someone else’s.
Take Inventory
The biggest determining factor in how much work it’s going to be to manage the online accounts and digital assets of someone who is incapacitated or deceased is whether they did any estate planning. If a person doesn’t write down what digital assets they have and what they want done with them, it’s impossible for anyone to know.
It’s not always a simple matter of memorializing a Facebook account or downloading photos from iCloud either. Digital assets can have as much monetary value as sentimental value. Say a person’s social media accounts earn dividends. How will a beneficiary collect future proceeds? And should they keep the account alive?
What about cryptocurrency? If it’s stored in a private wallet and no one has the key, the money is lost forever. It’s a different story, however, if a third party, like Coinbase or PayPal, holds the crypto. At present, bitcoin and other cryptocurrencies are considered “digital assets” and thus need to be treated that way when doing any estate planning.
Navigating the Law
In the US, digital inheritance is overseen by state law, the same as traditional probate and estate matters, according to Benjamin Orzeske, chief counsel at the Uniform Law Commission. He and his organization developed a state law known as the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which has been enacted in 48 states, Washington, DC, and the US Virgin Islands. The missing two states are Massachusetts, where RUFADAA has been adopted but not yet enacted as of this writing, and Louisiana, which went its own way with a similar but different law.
“At the heart of RUFADAA is this recognition that digital property is in some ways different from traditional, tangible property,” Orzeske says. He gives the example of mail versus email. When a person dies, their mail gets forwarded to a dedicated person, the fiduciary, who then receives incoming communication, bills, and payments. If they get a bill in the mail for a magazine subscription, they know to cancel it. Receiving the mail effectively gives the person appropriate information and access to manage the deceased’s accounts and estate going forward. Email is different. The fiduciary doesn’t just get new incoming mail. They might also have access to a searchable history of communication, which the deceased person might have expected to be kept private.
The real point of conflict, according to Orzeske, lies in the Stored Communications Act, a federal law that says companies that handle our online assets can’t release them without our permission. So RUFADAA gives survivors some rights while retaining the original asset holder’s privacy.
Under RUFADAA, a named trusted person can close accounts, but they can only get the contents—meaning the bodies of emails, private messages, videos, photos, attachments, and so forth—if the decedent specifically “grants the authority to the personal representative fiduciary,” according to Catherine Hodder, a senior attorney editor at FindLaw. FindLaw is an informational website that breaks down legal issues for a general audience.
The way to give that permission to a trusted person is to write it down, preferably in a will or similar document. Name the person and exactly what you want them to have, but do not list usernames or passwords, Hodder warns, because “the will is a public document.”
If the fiduciary is not given express permission to receive the contents of a digital asset, they might still be able to get a “catalog” of metadata, says Orzeske. Using email as an example again, that could include all the times and dates that emails were sent and received, maybe information about the sender or recipient, but still not the body of emails.
The Shortcomings of Built-In Tools
Many of the big tech companies that hold our digital assets, called “data custodians” in the law, have built-in tools that let you assign a trusted person to access your account when you die or if you become incapacitated.
Google has offered its Inactive Account Manager since 2013. Apple and Meta use the term “legacy contact” in some places, although you have to look for “memorialization” in Instagram. Enabling these features may seem like the easiest way to pass on your accounts, but in practice, the features leave much to be desired.
For example, if you want to give someone permission to download your Instagram content after you die, that person must also have an Instagram account. More importantly, someone must still reach out to Instagram to declare that a person has died in the first place. And how do you do that?
Mike Kiser, a co-chair of the Death in the Digital Estate Community Group at the OpenID Foundation, points out that “there is no defined way to tell a provider that someone has died or lost capacity.” His group has the long-term goal of developing protocols and guidance for users to be able to manage their digital estates.
Other hurdles and unforeseen problems crop up on a case-by-case basis. What happens if you never gave your real name or real date of birth to any of these companies? How can your trusted contact prove that an online account was actually held by you?
Even DIY Solution Can End in Failure
Tech-savvy people have long hacked together do-it-yourself solutions for passing on their digital estates. Some leave a printed document in a secure place listing all their accounts and credentials to get into them. Some leverage the legacy tools in a password manager, which is one of the better options in terms of security, but even the best solutions can come up short.
Kiser says that one of his colleagues created a DIY system for passing on his assets and decided to test it from the point of view of his trusted person. “He failed in step one,” Kiser says.
While researching this story, I experimented with my digital estate and realized that my two-factor authentication app is protected by biometrics. So even if my trusted person had all my credentials via a password manager, they couldn’t get very far without my fingerprint.
There’s also the sticky issue of violating a data custodian’s terms of service, which is likely what happens when someone other than you logs into your accounts. Whether a company would ever press charges is another matter, though it’s not hard to imagine times when they might, like when celebrities and public figures are involved.
A more likely scenario is that loved ones disagree about how to handle a decedent’s assets and accounts. If the wishes are written out in a will, family in-fighting might still take place, but the fiduciary at least has legal protection.
One other possibility is to create a local backup of all your data that someone can easily open. Send everything to a USB drive, leave it unencrypted, and voilà. Of course, you’ll have to regularly export and back up everything you want included, and it doesn’t solve the problem of terminating any online accounts you want closed after you’re gone.
What’s Best for Now?
Although every solution is imperfect, the best option seems to be naming a fiduciary or a trusted person in your will, then writing your specific wishes in that will or in a similar legal document, where you should be as detailed as possible. List the accounts and digital assets you have, name the person or people who should get them, and describe exactly what they should do.
If you go that route, remember to keep your list of passwords and login credentials separate; only share those with the specific people who need them. Also, do not enable those legacy features in your online accounts. According to Kiser, a platform’s own online controls take top priority and thus could override what you put into your instructions.
Most important of all, update your final instructions documents regularly, like whenever you make any changes to your accounts or move assets around.
