What Is RUFADAA? Understanding Your Rights to Digital Assets After Death

What Is RUFADAA and Why Does It Exist?

RUFADAA — the Revised Uniform Fiduciary Access to Digital Assets Act — is a model law created by the Uniform Law Commission in 2015 that gives fiduciaries (executors, trustees, guardians, and agents under power of attorney) the legal authority to access, manage, and distribute a deceased or incapacitated person's digital assets. It has been adopted by 48 states plus Washington D.C. as of 2025, making it one of the most widely enacted uniform laws in American history (Uniform Law Commission).

Before RUFADAA, there was no coherent legal framework for handling the digital belongings of someone who had died. Federal privacy laws like the Stored Communications Act (18 U.S.C. §2702) actually prohibited tech companies from disclosing a user's stored communications to third parties — including grieving family members. Terms-of-service agreements typically made accounts non-transferable. And even if a loved one had the deceased's username and password, logging into their account could technically constitute unauthorized access under the Computer Fraud and Abuse Act. The result was a legal vacuum that left families locked out of decades of photos, emails, financial accounts, and cryptocurrency holdings at the worst possible time.

The Uniform Law Commission — the same body responsible for widely adopted laws like the Uniform Commercial Code and the Uniform Probate Code — developed RUFADAA to fill that gap. The law creates a clear hierarchy of instructions for how digital assets should be handled, balances the interests of fiduciaries, privacy advocates, and technology companies, and applies to executors, trustees, court-appointed guardians, and attorneys-in-fact alike. If you've ever wondered what happens to your social media accounts or email accounts after you die, RUFADAA is the law that governs the answer in almost every U.S. state.

What Problem Was RUFADAA Designed to Solve?

RUFADAA was designed to solve the fundamental mismatch between how we live digitally and how the law handles death. A 2024 NordPass study found that the average person manages 168 personal online accounts (NordPass, 2024). According to a 2024 Bryn Mawr Trust survey, Americans estimate the average value of their digital assets at $191,516 — yet 76% reported having little or no knowledge about how to plan for those assets after death (Bryn Mawr Trust, 2024).

Before RUFADAA, the legal landscape for digital assets after death was fragmented and deeply inadequate. There were three core problems. First, terms-of-service agreements governed almost all online accounts, and most of those agreements made accounts non-transferable and terminated them upon the user's death. Second, federal privacy laws like the Stored Communications Act actually made it illegal for tech companies to hand over a user's electronic communications to anyone — including a court-appointed executor. Third, even families who had physical access to a deceased person's computer or phone had no clear legal authority to log into their accounts, creating the absurd situation where grieving relatives could be technically guilty of "hacking" for reading their late spouse's email.

The first attempt to fix this — the original Uniform Fiduciary Access to Digital Assets Act (UFADAA), completed in 2014 — tried to give fiduciaries the same blanket access to digital assets that they had to physical ones. Technology companies and privacy groups, including the ACLU, pushed back hard. They argued that UFADAA was too broad, would violate users' privacy expectations, and conflicted with existing federal law. Only Delaware adopted it. The Uniform Law Commission went back to the drawing board and produced RUFADAA — a compromise that won endorsements from both AARP and major tech companies like Google and Facebook (Nolo).

How Does RUFADAA's Three-Tier Priority System Work?

RUFADAA establishes a strict three-tier hierarchy that determines whose instructions control access to your digital assets after death or incapacity. Understanding this hierarchy is the single most important thing you can do to protect your digital legacy, because the tier structure means that some instructions will always override others — and if you don't set things up deliberately, a tech company's default terms of service will make the decisions for you.

What Is Tier 1: The Online Tool?

The highest-priority instruction under RUFADAA comes from an "online tool" — a feature provided by a platform that lets you specify what should happen to your account after death or inactivity. Online tools override everything: your will, your trust, your power of attorney, and the platform's own terms of service. If you configure Google's Inactive Account Manager to delete your Gmail after six months of inactivity, that instruction will be followed even if your will says your executor should preserve all digital assets.

RUFADAA defines an online tool broadly as "an electronic service provided by a custodian that allows the user, in an agreement distinct from the terms-of-service agreement, to provide directions for disclosure or nondisclosure of digital assets to a third person" (RUFADAA Full Text, Section 4). The most widely known examples include Google's Inactive Account Manager, Facebook's Legacy Contact, and Apple's Legacy Contact (introduced in iOS 15.2). These tools function essentially as a digital power of attorney for that specific platform.

The critical implication here is that online tools are platform-specific. Setting up a legacy contact on Facebook does nothing for your Google account or your bank's online portal. And because online tools sit at the top of the hierarchy, a careless or outdated setting on one platform can override a carefully drafted will. This is why reviewing your online tool settings across all major platforms should be part of your regular digital legacy planning routine.

What Is Tier 2: Legal Documents?

When a platform doesn't offer an online tool, or when a user hasn't configured one, RUFADAA looks to traditional legal documents — wills, trusts, and powers of attorney. This is the tier where deliberate estate planning makes the difference. If your will explicitly grants your executor authority to access your digital assets and electronic communications, that instruction controls.

There's an important nuance here. RUFADAA draws a sharp distinction between "digital assets" in general (files, photos, account records, cryptocurrency) and "electronic communications" specifically (the content of emails, private messages, and chats). By default, a fiduciary can access non-communication digital assets, but the content of electronic communications requires explicit consent from the user — either through an online tool or through clear language in a legal document. Without that explicit consent, a fiduciary can only obtain a "catalogue" of communications: the sender, recipient, date, and time — essentially the outside of the envelope, not the letter inside (Kitces, 2018).

This means that generic estate planning language — "I leave all my property to my spouse" — is almost certainly insufficient. Your will or trust needs to specifically mention "digital assets" and "electronic communications" and explicitly grant your fiduciary access rights. Standard will templates rarely include this language. If you're working with an attorney, ask them to include RUFADAA-compliant digital asset clauses. If you're using an online service, make sure the digital assets section is fully completed.

What Is Tier 3: Terms of Service?

When no online tool has been configured and no legal document addresses digital assets, the platform's default terms-of-service agreement controls. This is the tier that governs the vast majority of people's digital legacies — and it's almost always the worst outcome for their families.

Most terms-of-service agreements are written to minimize the company's liability and responsibility. Yahoo's (Oath's) terms, for example, explicitly state that all accounts are non-transferable and terminate upon the user's death. Other platforms may delete inactive accounts entirely after as little as 30 days. Given that most people scroll past terms of service without reading them — a reality famously satirized in a 2011 episode of South Park — relying on this tier means letting a corporate legal department decide what happens to your digital life.

The Caring.com 2025 Wills and Estate Planning Study found that only 24% of Americans have a will of any kind (Caring.com, 2025). The percentage who have specifically addressed digital assets in their estate plan is far lower. A Forbes analysis of the Bryn Mawr Trust data noted that fewer than 15% of Americans have an estate plan that covers digital assets (Forbes, 2025). That means the overwhelming majority of people are, by default, handing control of their digital legacy to Tier 3 — the tier that gives them the least protection and their family the least access.

What Exactly Does RUFADAA Consider a "Digital Asset"?

RUFADAA defines a digital asset broadly as "an electronic record in which an individual has a right or interest." This intentionally wide definition covers virtually anything stored or represented in electronic form, from the mundane to the financially significant.

In practice, digital assets fall into several categories. There are financial digital assets: online bank and brokerage accounts, cryptocurrency wallets on exchanges or in cold storage, PayPal and Venmo balances, and digital payment accounts. There are business digital assets: domain names, e-commerce storefronts, affiliate accounts, and intellectual property stored digitally. There are personal digital assets: cloud-stored photos and videos, email archives, social media profiles, and digital music or book libraries. And there are what might be called access assets: the login credentials and authentication information needed to reach any of the above.

RUFADAA does not, however, cover the physical device itself — your laptop or smartphone. Those are tangible personal property governed by traditional estate law. RUFADAA deals with the data on or accessible through the device. Think of the distinction as the difference between a filing cabinet (the device) and the files inside it (the digital assets). You might leave the filing cabinet to one person and the files to another. The same logic applies to a computer and its digital contents.

For a deeper look at specific asset types, our guides on what happens to cryptocurrency when you die and how to close accounts after death cover the practical side in detail.

Why Does RUFADAA Treat Electronic Communications Differently?

RUFADAA's most consequential design choice is the wall it erects between general digital assets and the content of electronic communications. A fiduciary can access most digital assets under RUFADAA's default rules. But to access the actual content of emails, private messages, direct messages, text logs, or chat conversations, the deceased must have given explicit prior consent — either through an online tool (Tier 1) or through specific language in a legal document (Tier 2).

This distinction exists because of the tension between RUFADAA and federal privacy laws, particularly the Stored Communications Act (SCA). The SCA, enacted in 1986 as part of the Electronic Communications Privacy Act, prohibits electronic communication service providers from voluntarily disclosing the contents of stored communications to third parties. When the original UFADAA tried to give fiduciaries blanket access to all digital assets including email content, tech companies argued that complying with UFADAA would force them to violate the SCA — putting them in an impossible legal position (Robins Kaplan, "RUFADAA and Its Implications").

RUFADAA resolved this by building the SCA's privacy protections directly into the law. Unless the user explicitly opts in to communication disclosure, fiduciaries get only the "catalogue" — the metadata. This means a fiduciary can see that the deceased sent an email to a particular address on a particular date, but cannot read what the email said. For families seeking emotional closure, this can be deeply frustrating. For privacy advocates, it's an essential safeguard. The practical takeaway is clear: if you want your executor or family members to be able to read your emails or messages after you're gone, you must say so explicitly in your will or trust.

Which States Have Adopted RUFADAA?

As of 2025, 48 states plus Washington D.C. have adopted some version of RUFADAA, making it nearly universal across the United States. The only states that have not fully adopted the law are Louisiana and Massachusetts, though both have related legislation under consideration. Delaware occupies a unique position — it adopted the original UFADAA (the pre-revision version) in 2014 and has continued to use its own law rather than switching to RUFADAA (Everplans).

While the widespread adoption means that most Americans are covered by substantially similar rules, there are meaningful state-by-state variations. California, which enacted RUFADAA effective January 1, 2017, added specific provisions related to trust administration. New York expanded protections for financial institutions and custodians. Texas broadened certain definitions of digital assets. These differences generally don't change the fundamental three-tier structure, but they can affect enforcement details, timelines, and custodian obligations.

If you've moved to a different state since creating your estate plan, it's worth confirming that your documents are compatible with your new state's version of RUFADAA. Caring.com's 2025 study found that roughly 10% of Americans no longer live in the state where their estate plan was originally created (Caring.com, 2025). Since digital assets don't respect state lines — your Google account doesn't know you moved from California to Texas — having documents that work in your current state of residence is essential.

What Are RUFADAA's Biggest Limitations?

RUFADAA is a significant step forward, but it has real limitations that anyone doing digital estate planning should understand. Knowing what the law cannot do is just as important as knowing what it can.

First, RUFADAA provides for disclosure, not necessarily full access. A custodian can comply with RUFADAA by giving a fiduciary a copy of records or a limited data download rather than full live access to the account. Google, for example, may provide a data archive rather than letting the executor log in and use the account. This means that some account features — ongoing subscriptions, recurring payments, stored settings — may remain inaccessible even with RUFADAA authority.

Second, the process is slow and expensive. Even with RUFADAA in place, accessing digital assets after death can take three to six months and may cost thousands of dollars in legal fees. Custodians retain the right to request court orders, charge reasonable fees for compliance, and limit their response to what is "reasonably necessary" for estate administration. For a family trying to access a deceased person's email to find outstanding bills or a cryptocurrency wallet with significant value, months of legal proceedings are hardly ideal.

Third, RUFADAA is a state law trying to operate in a space dominated by federal regulations and international tech companies. The relationship between RUFADAA and the Stored Communications Act remains legally uncertain in some respects. And platforms headquartered outside the United States may not recognize RUFADAA authority at all. If you hold digital assets on an international platform, your estate plan may need to account for foreign inheritance laws as well.

Fourth, RUFADAA doesn't address emerging categories of digital assets very well. Cryptocurrency in self-hosted wallets (cold storage) presents a unique problem: the "custodian" in RUFADAA terms is the wallet software or hardware, not a company that can receive legal notices. If the private keys die with the owner, RUFADAA offers no mechanism to recover them. An estimated $140 billion in Bitcoin alone is believed to be permanently inaccessible due to lost keys and deceased holders, according to analysis by Chainalysis (Chainalysis).

Finally, RUFADAA cannot compel a custodian to maintain an account indefinitely. If a platform's terms of service specify that inactive accounts will be deleted after a certain period, RUFADAA doesn't override that — unless the user has configured a Tier 1 online tool or a Tier 2 legal document that addresses the issue. This means that for platforms with aggressive account deletion policies, delay in estate administration can result in permanent data loss.

How Should You Plan Your Digital Estate Under RUFADAA?

Effective digital estate planning under RUFADAA requires action across all three tiers of the hierarchy. Relying on just one — even the highest-priority tier — leaves gaps that could lock your family out of important accounts or assets.

Start with Tier 1 by configuring the online tools offered by your most important platforms. Set up Google's Inactive Account Manager, Facebook's Legacy Contact, and Apple's Legacy Contact at minimum. Choose trusted contacts carefully and review these settings at least once a year. Remember that these settings override your will, so make sure your online tool designations are consistent with your broader estate plan.

Next, address Tier 2 by ensuring your will, trust, or power of attorney explicitly mentions digital assets and electronic communications. Use specific language that grants your fiduciary the authority to access, manage, copy, delete, and distribute your digital assets. If you want your executor to be able to read your emails and private messages — not just view the metadata — you must state this explicitly. Consult an estate attorney familiar with RUFADAA to make sure your language meets your state's requirements.

Then, create a comprehensive digital asset inventory — a master list of every online account, credential, and digital asset you own. Store it securely using a password manager with emergency access features, or in a sealed document kept with your other estate planning materials. This inventory is what transforms legal authority into practical access. Without it, even a fully empowered executor will struggle to find, let alone manage, your 168 online accounts. Our guide on how to choose a digital executor walks through how to select the right person for this role.

What Should You Include in a Digital Asset Inventory?

Your digital asset inventory should be comprehensive and organized by category. For each account, include the platform name, URL, username, password, two-factor authentication method and recovery codes, and specific instructions for what should happen to the account (transfer, archive, delete, or memorialize). Group accounts into categories: financial (banking, investments, crypto), communications (email, messaging), social media, cloud storage, subscriptions, business accounts, and any accounts with monetary or significant sentimental value. Update this inventory at least quarterly, or whenever you create a new account or change a password.

What Is the Difference Between RUFADAA and Simply Sharing Your Passwords?

Many people assume that writing down their passwords and handing the list to a family member solves the digital estate planning problem. It doesn't — and it can actually create new legal risks.

When someone logs into another person's account using shared credentials, they are technically accessing that account without being an authorized user from the platform's perspective. Under the Computer Fraud and Abuse Act (18 U.S.C. §1030) and similar state laws, this constitutes unauthorized access — even if the account owner willingly gave them the password. Most terms-of-service agreements explicitly prohibit sharing login credentials or allowing third-party access. A platform that discovers unauthorized access can terminate the account, delete its contents, and potentially pursue legal action against the person who logged in.

RUFADAA solves this by creating legal authority — not just practical access. When a fiduciary invokes RUFADAA with proper documentation (letters testamentary, court orders, death certificates), the platform is legally obligated to comply. The access is sanctioned by law, not smuggled in through a shared password. This distinction matters most when dealing with high-value accounts, contested estates, or platforms that actively enforce their terms of service.

That said, practical access through shared credentials can coexist with RUFADAA authority. Having both the legal right and the login information gives your fiduciary the fastest possible access while maintaining full legal protection. The key is to ensure that legal authority exists first, and shared credentials serve as a supplement — not a substitute.

How Does RUFADAA Connect to Afterlife Messages and Emotional Legacy?

RUFADAA is fundamentally a property law. It governs access to assets and records. What it doesn't address is the emotional dimension of digital legacy — the video messages, voice recordings, and written letters that families treasure most in the aftermath of a loss.

Research on bereavement consistently shows that what surviving family members value most is not account access or asset recovery but personal, emotional communication. A 2018 study in Death Studies found that bereavement-related regrets and "unfinished business" with the deceased — things left unsaid — are strongly associated with prolonged grief symptoms (Klingspon et al., 2018). RUFADAA can help your family access your email archive, but it cannot help them hear your voice telling them you love them.

This is where afterlife message services complement the legal framework. While RUFADAA ensures your executor can manage your Gmail account and recover your cryptocurrency, a service like LastWithYou ensures your family receives the words that actually matter — a video of you explaining why they meant the world to you, a message for your child on their wedding day, or a final note to your spouse. These two layers of planning — the legal and the emotional — work best together. For guidance on recording, see our complete guide on how to record a video message for your family.

What Steps Should You Take This Week?

Digital estate planning under RUFADAA doesn't have to happen all at once. But there are a few high-impact steps you can take immediately — most of them free and all of them achievable in under an hour.

First, configure Google's Inactive Account Manager. Go to myaccount.google.com, navigate to Data & Privacy, and look for "Make a plan for your digital legacy." You can add up to 10 trusted contacts, choose how long the account should be inactive before triggering the plan (three to eighteen months), and decide whether to share data, send a notification, or delete the account. This single action puts you ahead of the vast majority of internet users and establishes Tier 1 protection for what is often a person's most important digital account.

Second, set up Facebook's Legacy Contact and Apple's Legacy Contact if you use those platforms. Third, begin a digital asset inventory. Even a quick, handwritten list of your 20 most important accounts — email, banking, investments, social media, cloud storage — is a significant improvement over nothing. Fourth, review your will or estate plan. If it doesn't mention "digital assets" or "electronic communications," make a note to update it with RUFADAA-compliant language at your next attorney visit.

And fifth, while you're thinking about what you want to leave behind, record a message for the people who matter most. The legal infrastructure is important, but the people you love won't remember your RUFADAA compliance. They'll remember your voice.

Conclusion

RUFADAA represents the most important legal development in digital estate planning in the past decade. By establishing a clear three-tier hierarchy — online tools, then legal documents, then terms of service — it gives individuals meaningful control over what happens to their digital lives after death. The law has been adopted by 48 states plus Washington D.C., and it covers everything from email archives to cryptocurrency wallets.

But RUFADAA is a framework, not a finished product. It requires deliberate action on your part: configuring online tools, updating your will with specific digital asset language, building a comprehensive account inventory, and choosing the right fiduciary to carry out your wishes. Without those steps, the law defaults to whatever your platform's terms of service dictate — and those terms are written to protect the company, not your family.

The average American has 168 online accounts and nearly $200,000 in estimated digital asset value. Yet fewer than 15% have an estate plan that addresses digital assets at all. Closing that gap starts with understanding RUFADAA and taking the practical steps outlined in this guide. And while you're building the legal scaffolding for your digital legacy, don't forget the one thing no law can create for you: a personal message from you, in your own voice, waiting for the people who will miss you most.