Getting Into a Deceased Person's Online Accounts

The request seems modest: a family needs the email account to find the insurance policy, the utility bills and the subscriptions still charging a closed card. The provider's answer is that federal law prohibits it from handing over the contents of communications. Both positions are correct, and the statute that reconciles them is a state one.

Two statutes pointing in opposite directions

Federal privacy law restricts a service provider from disclosing the contents of stored communications except in defined circumstances, one of which is the lawful consent of the account holder. That restriction was written for interception and law enforcement access, not for bereavement, but it applies to a widow asking for her husband's inbox exactly as it applies to anyone else.

A state fiduciary access statute, now adopted in nearly every state, supplies the missing consent. It treats a direction given by the user as consent to disclosure, gives a personal representative standing to make the request, and gives the provider legal cover for complying. It also gives the provider several grounds to insist on a court order first.

The order of priority the statute creates

The framework is a ranking, and only the top rank is easy:

1. An online tool offered by the provider, where the user used it — a legacy contact, an inactive account manager, a designated successor. A direction given through such a tool overrides everything below it, including a contrary provision in a will.
2. A written direction in the user's own documents, such as a will, trust or power of attorney that expressly addresses digital assets.
3. The provider's terms of service, which apply where neither of the above exists — and which typically decline to disclose content to anyone.

The practical lesson runs backwards from that list. Five minutes spent in the account settings during a person's lifetime is worth more than any document drafted afterwards, and it is the only step in this entire subject that reliably prevents the problem.

Content and catalog are not the same request

Most families need the catalog rather than the content. Knowing that the account corresponded regularly with a named insurer, a bank and a pension administrator is generally enough to move the administration forward, and it is a far lighter request than asking to read the correspondence itself. Framing the request that way — naming what is needed and why — is more effective than a general demand for access.

What providers actually do

Practice varies more than the law does. Large platforms operate structured bereavement processes with published forms and predictable outcomes for closure and memorialization. Content disclosure is another matter: some providers will supply an export to a personal representative who submits letters from the probate court, others require a specific court order reciting the statutory findings, and a few decline in all circumstances.

Financial and commercial accounts sit outside this framework entirely and are usually simpler. A brokerage, a bank, a payment service or a retailer holding a balance is a business holding an asset, and it responds to the same documentation as any other institution — the affidavit or the letters that also release wages and property held by an employer. What makes an email or messaging account different is not the money in it but the privacy statute over it.

A workable sequence

The order below wastes the least time:

• Check the account settings first where any device remains logged in, looking only for a legacy contact or successor designation rather than reading the account.
• Deal with recurring charges immediately, through the card issuer or bank rather than the merchant, since stopping the payment is faster than closing the subscription.
• Secure the devices and the phone number. A number recycled by a carrier can hand two-factor codes to a stranger, and the number is often the recovery route for everything else.
• Submit closure and memorialization requests to each platform, using its bereavement form.
• Request the catalog where the administration needs it, and escalate to a content request only where a specific document is required and cannot be obtained from the institution that issued it.

That last point deserves emphasis, because it removes most of the need for this exercise. An insurer will confirm a policy without the email that mentioned it, and the free locator searches described in tracing a policy nobody can find work without any account access at all. The same is true of dormant balances, which surface through the state unclaimed property system rather than through an inbox.

Finally, treat the accounts as a security problem as well as an administrative one. Identity misuse after a death is common and is easiest in the window before institutions have been told, which is the practical argument for completing the notification sequence to agencies and credit bureaus early rather than at leisure.