What is RUFADAA, and how does it affect digital estate planning in the US?

The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) is a legal framework adopted in 47 US states that governs how fiduciaries access online accounts, establishing a priority hierarchy where user instructions set inside platform tools override conflicting wills or terms of service.

RUFADAA is the single most important law governing digital estate planning in the United States. Before RUFADAA, there was no legal mechanism for executors to access a deceased person's online accounts — platforms like Google, Facebook, and Microsoft simply cited their Terms of Service and refused access, even to legally appointed executors.

RUFADAA changed this by creating a legal framework that grants fiduciaries (executors, trustees, agents under power of attorney) the authority to access digital assets — but with important limitations and a strict priority hierarchy that determines who wins when there are conflicts.

As of 2026, RUFADAA has been adopted in 47 states and the District of Columbia. The three states that have not adopted standard RUFADAA are California, Louisiana, and Massachusetts — each has its own equivalent legislation with similar effect but different statutory language.

Use our Death Audit Checklist to ensure your estate plan complies with RUFADAA inventory requirements.

The RUFADAA three-tier priority hierarchy

RUFADAA establishes a strict three-tier hierarchy for determining who can access your digital assets and under what authority:

Tier 1: Platform-level instructions (Highest priority) If you've used a platform's built-in tool to designate what happens to your account, those instructions take precedence over everything else. Examples: • Google Inactive Account Manager — you specify who gets access and after how long • Apple Legacy Contact — you designate someone to access your Apple ID data • Facebook Legacy Contact — you choose someone to manage your memorialized profile

Tier 2: Will or estate documents (Middle priority) If you haven't set platform-level instructions, your will or power of attorney can grant your executor authority over digital assets. This requires explicit language — a general "my executor shall have access to all my property" clause is often insufficient.

Tier 3: Terms of service (Lowest priority) If neither tier 1 nor tier 2 applies, the platform's terms of service determine what happens. In most cases, this means the account is frozen or deleted, and no one gets access.

The critical insight: Tier 1 overrides Tier 2. If you set Google's Inactive Account Manager to delete your account after 3 months of inactivity, but your will says your executor should have access to your emails, Google will follow the Inactive Account Manager instructions, not your will.

How to ensure RUFADAA compliance in your estate plan

Step 1: Set up platform-level legacy tools (Tier 1) Configure the built-in legacy features for your most important accounts: • Google Inactive Account Manager — specify trusted contact and timeout period • Apple Legacy Contact — designate someone and share the access key • Facebook Legacy Contact — choose a friend or family member • Microsoft / OneDrive — check for legacy access features • Twitter / X — check for account deletion or memorialization options

Step 2: Add digital asset clauses to your will (Tier 2) Work with an estate attorney to include: • An explicit clause authorizing your executor to access, manage, and close digital accounts • A specific grant of access to the content of electronic communications (required under RUFADAA in most states) • The name of your designated digital executor (can be the same as your regular executor) • An inventory clause referencing where your digital asset inventory is stored

Step 3: Store credentials in a encrypted delivery (practical execution) RUFADAA gives your executor legal authority, but they still need the actual credentials. Store all passwords, 2FA codes, and access instructions in a ZeroLatch encrypted vault. Configure the dead man's switch to deliver these credentials to your executor after verified inactivity.

Step 4: Keep the will and the credentials separate Your will (public after probate) describes WHAT should happen. Your ZeroLatch vault (private, encrypted) contains the HOW — actual passwords and keys. This separation prevents security exposure while maintaining legal compliance.

Use our Death Audit Checklist to verify your RUFADAA compliance across all tiers.