When most people picture an estate, they picture things you can hold or stand in: a house, a car, a bank passbook, a box of papers in a closet. The plan that gets drafted tends to follow that picture. It moves the house, the accounts, and the papers. Then someone dies, and the family discovers that a large part of the person’s life was not in the closet at all. It was behind a login. The photos are in a cloud account no one can open. The bills arrive by email to an inbox no one can read. There may be a brokerage app, a small balance of cryptocurrency, years of frequent-flyer miles, a business page with a following, and a subscription or two that keeps charging the card every month. None of it came with a key.
Digital assets estate planning is the part of a plan that deals with this second, invisible estate. It is newer than wills and trusts, and the law around it is still settling. But the practical problem is immediate and it is common. I have watched families who had every paper document in order spend weeks locked out of an email account, unable to find out what bills were due or what accounts existed, because the one person who knew the password was the person they had lost. This is also one of the clearest places where Rhode Island and Massachusetts part ways. Rhode Island has adopted a statute, RUFADAA, that gives fiduciaries a defined path to digital assets. Massachusetts has not, which leaves Massachusetts families relying on provider rules, federal privacy law, and whatever authority their own documents happen to contain. This article explains what digital assets are, why fiduciaries struggle to reach them, how RUFADAA changes the picture in Rhode Island, what Massachusetts families have to do instead, and what anyone can do now so that the people they trust are not left guessing. For the broader context, see our estate planning overview.
1. What counts as a digital asset
A digital asset is, roughly, anything you own or control that exists as a record or account online or on a device. That definition is broad on purpose, because the category keeps growing. It helps to sort it into a few groups.
The first group is financial. This includes online banking and brokerage logins, payment apps, accounts at app stores, and any cryptocurrency held in an exchange account or a private wallet. Some of these hold real value. Some are just access points to value that lives elsewhere. Either way, a fiduciary often needs to get into them to understand what the estate owns.
The second group is communication and records. Email is the most important item here, and it is easy to underestimate. An email inbox is usually the master key to a person’s financial life, because it is where statements, tax notices, password resets, and account confirmations all arrive. Lose access to the email account and you often lose the trail to everything else.
The third group is sentimental and personal. Photographs and videos stored in the cloud, documents in an online drive, and message histories fall here. These rarely have market value, but for a grieving family they are frequently the assets that matter most, and the ones that are hardest to recover once an account is closed.
The fourth group is what might be called accumulated or commercial value: loyalty points and airline miles, a domain name, a monetized social media or content account, a small online store. Some of these can be transferred and some cannot, depending entirely on the provider’s rules.
A useful way to think about all of this is that almost none of it lives on a piece of paper, and much of it lives on a company’s servers rather than on a device you own. That single fact is the root of most of the trouble that follows.
2. What families commonly assume
Two assumptions cause most of the difficulty, and both are reasonable.
The first is that whoever is named in charge, the executor or trustee, can simply call the company, explain the situation, and be let in. People expect digital accounts to work the way a bank branch worked a generation ago, where a death certificate and some patience eventually opened the door. With online providers that is frequently not how it goes. The person on the other end is bound by the company’s terms of service and by federal privacy law, and the default answer to a stranger asking for access to someone else’s account is no.
The second assumption is that knowing the password is the same as having the right to use it. A spouse may have the login written on a card, or may know it by heart, and may quietly keep using the account after a death. This feels harmless. The risk is that logging into someone else’s account, even with a known password and good intentions, can run against the provider’s rules and, in some readings, against federal computer-access law. In practice families do this constantly, but a fiduciary acting in an official capacity should not have to rely on a legal gray area to do the job. The cleaner path is to have actual authority.
3. Why fiduciaries get locked out
The reason this is hard is not that companies are heartless. It is that two bodies of law point in opposite directions, and digital accounts sit between them.
On one side is privacy law. Federal statutes were written to stop providers from handing over the contents of private electronic communications to people who are not the account holder. Those laws did their job for living users. They were not written with death and inheritance in mind, so for years they gave companies a strong reason to refuse a grieving executor: the safest legal choice was to disclose nothing.
On the other side is estate law, which has always assumed that a fiduciary steps into the shoes of the person who died and can gather their property. For physical assets that works. For a cloud account, the fiduciary would arrive with valid authority under state law and meet a provider who pointed to federal privacy law and to its own terms of service and declined.
The result, for a stretch of years, was a standoff. Executors had authority on paper that custodians would not honor in practice. The custodian was not being unreasonable; it was trying not to violate federal law. This is the gap that RUFADAA was written to close, and it is also where Rhode Island and Massachusetts now stand in different places.
4. How RUFADAA changes the picture, and why the two states differ
RUFADAA is the Revised Uniform Fiduciary Access to Digital Assets Act. It is a model law, meaning a drafting body wrote a standard version and then individual states chose whether to adopt it. A large majority of states have. The point of the act is to give fiduciaries a lawful route to digital assets while still respecting the account holder’s privacy and choices.
This is where the two states diverge, and the difference is worth understanding before you assume which rules apply to you. Rhode Island has adopted RUFADAA, codified at R.I. Gen. Laws ch. 33-27.1 (enacted in 2019). A Rhode Island executor, trustee, or agent under a power of attorney has a statutory framework to point to when a provider hesitates. Massachusetts is one of the few states that has not enacted RUFADAA. Bills have been filed there more than once. As of August 4, 2026, H.4639 and S.1110 remained pending, and no Massachusetts RUFADAA statute had taken effect. A Massachusetts fiduciary therefore cannot rely on a state digital-assets statute. Instead, that fiduciary falls back on the provider’s terms of service, the federal Stored Communications Act, and whatever authority the deceased or incapacitated person built into a well-drafted will, trust, or power of attorney. The practical lesson cuts in opposite directions: a Rhode Island family has a statute working in its favor but still benefits from clear document language, while a Massachusetts family has no such statute and so the document language is doing nearly all of the work.
4.1 The order of authority
The most important thing RUFADAA does is set a priority order for who decides what happens to an account. Understanding the order is what lets a plan actually work.
This priority order is the heart of the Rhode Island statute, and it is also the structure Massachusetts families end up imitating by contract and document language even without a statute behind them.
At the top sits the provider’s own online tool, if it offers one and the user used it. Some companies let you name, inside your account settings, a person who may manage or close the account after you die or become incapacitated. When a user has filled that out, that choice generally controls, because it is the most direct expression of the user’s intent.
If there is no online tool, or the user did not use it, the next authority is the user’s own estate-planning documents: the will, the trust, the power of attorney. Language in those documents that grants a fiduciary authority over digital assets steps in to fill the gap. In Massachusetts, where there is no RUFADAA to supply the framework, this document language matters even more, because it is often the strongest authority a fiduciary can show.
Only if neither of those speaks does the provider’s general terms-of-service agreement decide. That is the least favorable position, because terms of service are written to protect the company, not to help your family. It is also, notably, closer to the default a Massachusetts fiduciary starts from, since Massachusetts has no statute pulling the provider toward disclosure.
The practical lesson is plain. If you do nothing, you are leaving the decision to the bottom tier, the fine print you clicked past when you opened the account. The two higher tiers, the online tool and your own documents, are where you get to be heard, and they are available to anyone willing to take a little time now, in either state.
4.2 Content versus catalogue
RUFADAA also draws a line that surprises people. There is a difference between the contents of a communication, meaning the actual words of an email or message, and the catalogue of a communication, meaning the record that a message was sent, to whom, and when. The act generally treats the private contents of communications as more protected. A fiduciary may be able to obtain a catalogue or an inventory of an account more readily than the full text of private messages, and disclosure of contents requires the user’s consent or a court direction, and the custodian may also require specified documents and court findings. This is why generic authority is not enough. The documents need to say, in plain terms, that the fiduciary may access the content of electronic communications, not just the existence of them. The point holds in Massachusetts too, with even more force, because there the federal Stored Communications Act remains the main obstacle and the user’s own written authorization is often the only thing that moves a provider to disclose content.
5. Where things go wrong
The failures in this area are rarely dramatic. They are quiet and avoidable, and they tend to repeat.
The most common is silence. The estate-planning documents say nothing about digital assets at all, because they were drafted before this was a known issue or because no one thought to raise it. The fiduciary then has authority over the bank account and the house but stands outside the email and the cloud, holding a death certificate that the provider will not honor for content.
A close second is the password binder problem, which is really two problems wearing the same coat. Some people leave no record of credentials anywhere, and the family is locked out of everything. Others leave a paper list of passwords in a drawer or a file, which solves access but creates a new exposure. A written master list is a theft and fraud risk while the person is alive, and it goes stale the moment a password changes, which is often. Neither extreme works well.
Cryptocurrency deserves a special mention because it is unforgiving. If coins are held in a private wallet rather than on an exchange, access depends on a private key or a recovery phrase. There is no customer service line, no password reset, and no court order that can recover the key. If the key is lost, the asset is generally gone for good. I have seen families who knew a relative held cryptocurrency and could see, in a sense, that it existed, yet could never reach it because the recovery phrase died with the owner. For this asset class, planning is not a convenience. It is the only thing that prevents a total loss.
There are also the small, persistent leaks. Subscriptions that keep charging a closed-out card. A business page that goes dark and damages a livelihood the family was counting on. Loyalty balances worth real money that quietly expire because no one knew to claim them in time. None of these are catastrophes on their own. Together they are the kind of slow erosion that a small amount of foresight prevents entirely.
6. How planning changes the outcome
The good news is that this is one of the more fixable problems in estate planning, because most of the work is organization rather than litigation. A few moves, done while a person is well, change the picture completely.
The first is to use the providers’ own tools. Where a major account offers a built-in way to name a legacy contact or an inactive-account manager, using it is the single highest-value step available, because under RUFADAA that choice tends to sit at the top of the priority order. It takes a few minutes inside account settings and it speaks with more authority than almost anything else.
The second is to make sure the estate-planning documents actually address digital assets. A will, a trust, and especially a durable power of attorney can each include language granting the named fiduciary authority over digital assets and, importantly, authority to access the content of electronic communications, in the specific terms RUFADAA contemplates. A power of attorney matters here as much as a will, because the access problem often arrives during incapacity, not only at death. Older documents drafted before this was on anyone’s radar are the ones most likely to be silent, which is a common reason families revisit a plan.
The third is to keep a secure inventory, separate from the documents that grant authority. An inventory is not a list of passwords taped to a monitor. It is an organized, protected record of what accounts and assets exist and where they live, so the fiduciary knows what to look for and is not reduced to guessing. A reputable password manager is one practical way to hold credentials securely while a person is alive, with a designated way for a trusted person to gain emergency access. The goal is that the fiduciary can find the door, while the authority to open it comes from the documents and the providers’ tools rather than from a sticky note.
A short, plain checklist captures the practical steps:
- Make a written inventory of digital accounts and assets: financial logins, email, cloud storage, social media, domain names, loyalty programs, and any cryptocurrency. Note where each lives, not the passwords themselves.
- Use each major provider’s built-in legacy or inactive-account tool where one exists, and name a trusted person.
- Store credentials in a reputable password manager with a clear, secure way for a trusted person to gain emergency access.
- Record cryptocurrency recovery phrases and private keys in a secure place, with instructions, since these cannot be reset or recovered.
- Ask whether your will, trust, and durable power of attorney each grant authority over digital assets and access to the content of electronic communications.
- Cancel or list recurring subscriptions so they do not keep charging after death.
- Review the inventory periodically, because accounts and passwords change.
7. When this question signals it is time to talk to a lawyer
Some of this is housekeeping that anyone can do over a weekend: making the inventory, setting up a password manager, naming legacy contacts. That part does not require a lawyer, and it is worth doing regardless.
The legal side is narrower but it is the part that fails quietly. If your estate-planning documents were signed before digital access was a known issue, they may say nothing about it, and the gap will not show up until a fiduciary is standing in front of a locked account. If you hold cryptocurrency, run an online business, or keep something behind a login that the wrong person could reach or the right person could not, the stakes are higher than they look. And if you are already serving as an executor or agent and a provider has told you no, the question becomes how to use RUFADAA, your authority, and if necessary the court to get what the estate is entitled to. Those are the moments when this topic stops being organization and becomes a legal question worth raising with someone who handles these matters in Rhode Island and Massachusetts.
Frequently Asked Questions
What exactly is a digital asset?
It is broadly any account, file, or record you own or control that exists online or on a device. That includes online banking and brokerage logins, email, cloud-stored photos and documents, social media accounts, domain names, loyalty and airline-miles balances, and cryptocurrency. Some hold real money, some are mainly access to value held elsewhere, and some have only sentimental worth.
Why can’t my executor just call the company with a death certificate?
Online providers are bound by their terms of service and by federal privacy law, which discourage disclosing the contents of someone’s account to anyone but the account holder. For years that left executors with authority on paper that companies would not honor in practice. In Rhode Island, RUFADAA now gives fiduciaries a lawful route, though it still depends on the right tools and document language being in place. In Massachusetts, which has not adopted RUFADAA, that document language matters even more, because there is no state statute to lean on.
What is RUFADAA, and does my state have it?
It is the Revised Uniform Fiduciary Access to Digital Assets Act, a model law that most states have adopted, which gives executors, trustees, and agents under a power of attorney a legal path to access a person’s digital assets while still protecting privacy. It sets a priority order: a provider’s online tool first, then the user’s estate-planning documents, then the provider’s general terms of service. Rhode Island has adopted it, at R.I. Gen. Laws ch. 33-27.1. Massachusetts has not, so Massachusetts fiduciaries rely on provider terms, the federal Stored Communications Act, and well-drafted authority in a will, trust, or power of attorney.
Is it enough to leave my spouse a list of passwords?
A list helps with access but it is not the same as legal authority, and it carries its own risks. A written password list is a fraud and theft exposure while you are alive, and it goes out of date the moment a password changes. The stronger approach pairs a secure inventory or password manager with clear authority in your will, trust, and power of attorney, plus the providers’ own legacy tools.
What happens to cryptocurrency if the key is lost?
If cryptocurrency is held in a private wallet, access depends on a private key or recovery phrase, and there is no reset and no customer-service recovery. If the key is lost, the asset is generally gone permanently. This is the digital asset where careful, secure recording of access information matters most, because no court order can recover what cannot be unlocked.
Does my power of attorney cover digital accounts?
Only if it says so. The access problem often arises during incapacity rather than at death, so a durable power of attorney that grants authority over digital assets, including the content of electronic communications, is as important as the will. Documents drafted before this was a recognized issue frequently say nothing, which is a common reason to update them.
Can my fiduciary read all of my emails?
Not automatically. RUFADAA generally treats the private content of communications as more protected than a simple record that messages exist. A fiduciary may reach an inventory of an account more readily than the full text of messages, and accessing content often requires specific authorizing language or, in some cases, a court order.
Do I still need to do anything if I have used an online legacy tool?
Using a provider’s built-in legacy or inactive-account tool is one of the strongest steps you can take, because that choice tends to sit at the top of RUFADAA’s priority order for that account. But it only governs that one provider. A complete plan still addresses the accounts that offer no such tool, which is where your estate-planning documents do the work.
—
If these questions are surfacing for your family, a short conversation can help you understand the options before any decisions are made.
By Matthew Fabisch, Esq. – Former Rhode Island Probate Judge • Founder, Fabisch Law Offices • Trusts & Estates Attorney • Father of Four
Guiding Families. Protecting Legacies. Building Peace of Mind.