Death in Cyberspace: Protecting digital estates

by Jon M. Garon

Each day, an ever-growing percentage of the population moves important information to the cloud—online services storing correspondence, contracts and legal documents, photographs, financial records and more. Although many of these items have little financial or emotional importance, others may be critically important to the management or worth of an estate. The website of a modern writer may rival the importance of his or her published and unpublished manuscripts. A child’s Facebook page can serve as a touching memorial for parents in grief. A list of friends or followers may have significant financial value to a closely held business with a value comparable to a customer list or similar corporate trade secrets.

Although death is inevitable, the effect of death on one’s digital assets is far from clear. Very few laws address the issue. Moreover, many of these assets are governed by contract or vendor practice rather than state testamentary law.

In 2004, Yahoo! came under significant public criticism for enforcing its nontransferability provisions when Justin Ellsworth, a 20-year-old marine, was killed in Falluja, Iraq, and Yahoo! refused to provide his father with access to his account.1 At the time, Yahoo! explained that it would “turn over the account to family members only after they go through the courts to verify their identity and relationship with the deceased.”2 Yahoo! also added pressure on the family because “[a]fter 90 days of inactivity, Yahoo! deletes the account.”3 A court ultimately gave the contents of the late Ellsworth’s account to his parents, but upheld the terms of the contract denying the right to continue using the account.4

The opinion was unpublished and had no binding precedent. For Yahoo!, it also did not affect its policy. Even today, Yahoo! provides the following limitation in its contract:

No Right of Survivorship and Non-Transferability. You agree that your Yahoo! account is nontransferable and any rights to your Yahoo! ID or contents within your account terminate upon your death. Upon receipt of a copy of a death certificate, your account may be terminated and all contents therein permanently deleted.5

In contrast, Facebook has a procedure dedicated to addressing issues with deceased participants.

[Facebook] will process certain special requests for verified immediate family members, including requests to remove a loved one’s account. This will completely remove the profile (timeline) and all associated content from Facebook, so no one can view it. For all special requests, we require verification that you are an immediate family member or executor. Requests will not be processed if we are unable to verify your relationship to the deceased.6

The Facebook policy, however, is not contractually included among terms of service. Moreover the provision creates a rather broad category of potential agents to control the decedent’s Facebook account. The voluntary provision does not require an executor nor differentiate among family members. This may prove more convenient for most families, but it exacerbates the problem for those families where spouses, children or partners are not in agreement regarding the decedent’s wishes.

States struggle to provide statutory protection
Recognizing the growth of this issue, five states have taken action to address various aspects of these rights.7 The first of these was enacted in Connecticut in 2005 covering only email.8 The Connecticut law appears to be a direct response to the outcry generated by the treatment of the Ellsworth family by Yahoo!. A very similar law was enacted in Rhode Island in 2007.9 Oklahoma and Idaho have followed with similar laws, expanding email to include blogs and social media such as Facebook and Twitter.10

The laws are quite limited. Oklahoma’s statutory provision, for example, provides that the “executor or administrator of an estate shall have the power, where otherwise authorized” to control the account. In the case of Yahoo!, the subscriber has agreed in the non-negotiable, clickwrap agreement that the account is not transferable.11 As such, the lack of transferability or access would still govern. Since this policy applies to services such as the Yahoo! photo-sharing site Flickr, a decedent’s entire photo history will be wiped out upon death.

Indiana has attempted to go one step further with a more comprehensive statute. The Indiana act requires that the trustee or representative of the estate be provided “access to or copies of any documents or information of the deceased person stored electronically… .” The Indiana act also requires that the information not be destroyed for two years.12

While still a relatively simple provision, the Indiana statute improves over other laws because it is not limited to particular types of Web services. The Indiana law extends to cover photo-sharing sites, mobile apps and a variety of other online services.

The Indiana statute has two limitations, one for disclosure of information that would violate federal law and another for information for which the decedent would not have had his or her own access.13 There is certainly the potential for overlap with federally protected information, such as financial records, health records or student records. Each of these types of stored electronic information is subject to federal privacy laws, so some of that information may preclude a trustee from gaining access. The law may provide too much access for a trustee if the documents are confidential or privileged and of a type that should be controlled by one’s employer rather than one’s family. Still, the law is a significant improvement over the majority of states.

Even the broader Indiana law does not address the continued use of an existing account. While this is not likely to matter for a personal email account, it could make a difference if that account was used in a small business or as the account to which notices of copyright violations are to be sent.14 It could also make a significant difference if a personal blog or Twitter account is used to promote a business.

Good preparation matters
For important online assets, everyone who spends valuable time online should begin planning for the inevitable day when someone else will need to take over their online presence. The digital estate management firm Entrustet has analyzed Facebook’s user data to suggest that potentially 408,000 U.S. Facebook users (and 1.78 million users worldwide) will die in 2011.15 The planning is important for both testamentary and conservatory purposes, so that appropriate steps can be taken if a person were to become incapacitated as well as to pass away. The good news is that careful inventories will also help manage the deluge of account information that is increasingly becoming a burden in life as well as death.

As with any estate plan, the first step is a careful audit of one’s assets. In the case of either death or incapacity, the first important step is to track down and identify all of the assets, liabilities and other concerns that must be addressed.16 The list may quickly become quite long:

  • Email accounts and cross-platform login information; 
  • Websites, hosting services and URLs; 
  • Facebook, Twitter, LinkedIn, Google+ and other social media accounts; 
  • Audio, visual and audiovisual content–MySpace, GarageBand, YouTube, Flickr, Picasa, Google Docs, Scribd, etc.;
  • Financial services accounts including banking, stock trading, credit card, prepaid cards, pre-paid accounts, shopping accounts and auto-debiting accounts; 
  • Devices including computers, USB drives, smart phones and PDAs; 
  • Medical records; 
  • Cloud computing services and remote storage; and 
  • Video game, virtual world and other accounts.17

As an ongoing matter, users should begin keeping an updated log of each new account they open along with the user name for such account. The password for each account should also be kept, but that information should be maintained separately from the list of accounts so that the estate plan does not serve as a skeleton key to unlock the security measure undertaken to protect the assets in life. Any physical assets—disks, back-up media, USB drives, computers, mobile devices—should also be inventoried.

All of us are becoming archivists of our lives. The time and effort needed to manage our digital estate will be a function of the size of the material one creates and the clarity with which we have managed that information.

Older media and media difficult to access should be replaced. It is better for the owner of the content to decide whether to transfer files from 3.5 diskettes (or worse—five-inch disks) than to make the trustee go to the expense. Since the trustee may be unable to assess the value of the old media without transferring it, the trustee will be compelled to waste time and money for files of little value. Media that is not worth transferring can be labeled, either in the inventory or physically on the media. Labeling will make a tremendous difference in managing one’s assets after death.

On a computer and in email attachments, valuable files do not stand out as more important than the others. A person’s portfolio of prize photographs, unreleased songs, novels or screenplays will look much like the clutter of work memos and hastily snapped photos from one’s phone. Items of value should clearly be marked. Again, this can be done both on an inventory sheet and on the media. A “do not delete” directory sends a clear signal to treat that folder with extra care.18

When planning for the eventual disposition of one’s digital estate, a person should carefully select who will be assigned to handle the management. The delegation may be two-fold. The person who is best able to read the media, navigate online and manage access may not be the best person to decide what is important or how to fulfill the testator’s wishes. The neighbor kid who programs electronics and sets up the family’s wireless network is an unlikely candidate for trustee, so the different tasks should be separated.

The delegation of authority may require multiple or co-executors so that there is appropriate competency to handle the digital aspects of the estate as well as the other assets. Alternatively, the trustee may need to delegate agents for certain tasks and the estate plan should give the trustee that authority.

As described in some of the usage policies, some companies require notification and proof of death to provide family access. Others may require a court order. But it is much easier to access the accounts with the appropriate user name and password information. The passwords should be provided in a manner that keeps them separate from one’s accounts. Encrypted directories or hard copies kept safely will provide a reasonable balance between present security and future frustration. For more valuable assets, use of a safe deposit box or deposit with an attorney may be appropriate.19

For assets that have significant financial importance from their ongoing usage, the delegation may require a migration to a vendor that permits assignment or to some other strategy. In some cases, it may be prudent to transfer ownership to an LLC or solely held corporation—or form one if necessary—so that the assets are owned by an entity with perpetual life. Ownership of the entity can transfer (in most cases) without triggering the closing of the account. This is a significant undertaking, but for blogs, domain names or other assets with large good will value, the investment may be critical.

A number of vendors have begun offering their services to assist with these steps as well. Such services may be quite helpful, but as with any new industry, there has yet to be a long track record of proven success and reliability. These tools will prove quite useful, but one should be cautious before entrusting one’s valuable assets to an unknown company.

Take care
The present laws protecting digital assets simply do not do enough to address the need to protect digital assets at the time of death or incapacity. The public must begin taking care to assure that the important remembrances, business assets and other information they have put online is available to their heirs in the manner they choose.

Although new laws are certainly necessary, individuals can do a great deal to protect these assets and plan for their friends and family. By inventorying one’s digital assets, planning for the future and making the material available to one’s executor, a person can go a long way to make their memories live on.

Jon M. Garon is director of the Northern Kentucky University Chase Law & Informatics Institute and is a professor of law at the university’s Salmon P. Chase College of Law.

1 “Yahoo! denies family access to dead marine’s e-mail,” by Jim Hu, CNET, Dec. 21, 2004, visited Dec. 5, 2011).

2 Id.

3 Id.

4 Jennifer Chambers, “Family gets GI’s e-mail,” The Detroit News, Apr. 21, 2005 at 1.

5 Yahoo! Inc., Terms of Service, (last visited Dec. 3, 2011).

6 Facebook Help Center, How do I submit a special request for a deceased user’s account on the site?, (last visited Dec. 3, 2011).

7 Digital Beyond, Digital Estate Resource, (last visited Dec. 7, 2011).

8 C.G.S.A. §45a-334a (2005) (Connecticut Public Act No. 05-136) (An Act Concerning Access to Decedents’ Electronic Mail Accounts).

9 Rhode Island §33-27 (2007) (“Access to Decedents’ Electronic Mail Accounts Act”).

10 58 Okl. St. Ann. §269 (2011); I.C. § 15-5-424 (2011) (Idaho Code Ann.).

11 Naomi Cahn, “Postmortem Life On-Line,” 25 Probate and Property 36, July/August, 2011 at 38.

12 IC 29-1-13-1.1 (2007) (Annotated Indiana Code).

13 Id.

14 See, e.g., Ellison v. Robertson, 357 F.3d 1072 (9th Cir. 2004) (AOL failed to have its copyright notice account forward emails to a staff member, vitiating its protections on the notice-and-take-down safe harbor).

15 Entrustet HIWI Blog, (last visited Dec. 3, 2011).

16 Dennis Kennedy, Estate Planning for Your Digital Assets, Law Practice Today, March 2010, at (last visited Dec. 4, 2011).

17 Id.

18 Id.

19 Cahn, supra note 11 at 38.



Staff Directory

Contact Information


8 A.M. - 5 P.M.
Monday - Friday