A will can direct who inherits a house, a car and a brokerage account, and the probate system has four centuries of practice enforcing it. It has almost no power over an email account. The reason is a federal privacy statute written in 1986, the Stored Communications Act, which forbids a service provider from divulging the contents of a customer's communications to anyone, and contains no exception for the customer's estate. A court can name an executor. That does not oblige Google to hand over a mailbox.
States responded with a uniform law, adopted now by nearly every state, that gives a personal representative standing to ask. What makes it work is not the standing itself but a specific carve-out in the federal statute: providers may disclose content with the user's lawful consent. The uniform act supplies that consent by treating the user's own recorded instructions as the authorization. Which is why the priority order it establishes runs in an order most people would not guess. An instruction left in the platform's own tool outranks a will. A will outranks the platform's terms of service. The terms of service govern only if the person did neither, and by default that produces the least access.
The Tool Beats the Will
That first tier is the practical heart of it. Google's Inactive Account Manager lets a user nominate up to ten trusted contacts, choose what each may receive, and set the period of inactivity that triggers it. Apple's Legacy Contact issues an access key that the contact presents alongside a death certificate. Facebook has a legacy contact who can memorialize a profile. Each of these takes a few minutes and, crucially, overrides whatever a will says, because it is the most recent and most account-specific expression of consent the provider has.
Without one, the fallback is grim and slow. Google states plainly that it cannot provide passwords or login details under any circumstances, and there is a trap worth knowing: if the family asks Google to close the account, Google cannot afterward process any request for its contents. Closure is irreversible in that respect and it is often the first thing a grieving family thinks to do. Apple requires a court order absent a legacy contact. Microsoft has no legacy contact feature at all and, by multiple accounts, now directs families to serve a subpoena or court order. Facebook's legacy contact can change a profile photo but cannot read the messages.
The Mechanics of Content Versus Catalogue
The distinction that governs all of this is between content and what the law calls the catalogue. Content is the message itself. The catalogue is the record of it: who corresponded with whom, and when. The federal statute treats these completely differently, permitting providers to disclose customer records to any non-governmental person while barring disclosure of contents. This is why families routinely report the same maddening outcome, receiving a list showing that hundreds of messages exist without being allowed to read a single one. Nobody at the company is being obstructive. They are following a statute written before any of these services existed.
The Layer the Law Does Not Reach
Underneath sits a layer the law does not reach at all. Password managers are built so the vendor cannot see the vault, which means that if no emergency access contact was configured, the vendor genuinely cannot recover it. Two-factor codes sent to a mobile number stop working the moment the family cancels the phone line, which is usually one of the first bills they cancel, and cancelling it can lock them out of the email account that every other password reset runs through. Self-custodied cryptocurrency keys are unrecoverable by anyone. Subscriptions, meanwhile, keep billing: the federal rule that would have required a simple cancellation path was struck down by an appeals court in July 2025, and the regulator only moved to restart the rulemaking this January, so there is currently no federal easy-cancel right for an executor unwinding recurring charges.
The Afternoon That Prevents All of It
Newer services have not caught up either. No major provider offers any posthumous designation for artificial intelligence chat histories, which for some people now hold more personal reflection than their email does.
None of this requires a lawyer. The single most useful estate document for digital accounts is not in the will at all, because a designation made inside the account itself legally outranks anything the will says about it. An afternoon's work covers most of the exposure: set the legacy or inactive account contact in the two or three accounts that matter most, configure emergency access in the password manager, write down which phone number the two-factor codes go to along with an instruction not to cancel that line until account access is finished, and leave a plain list of recurring subscriptions with the account each is billed to.
— John Stone