In the case of a deceased relative, is there any law violation in any of these circumstances in relation to an online account (let's say google, facebook, twitter, msn, etc)?

Countries interested: USA, Mexico, Japan, UK

  1. If I know the password and I access their account
  2. If I don't know the password and I try to recover it
  3. If I recover the password and access their account

Does the intention matters until those points?

  • FWIW, the underlying general principles in Mexico are traceable largely to the Civil Code of Spain upon which its probate and property laws were based, and in Japan, upon the probate and property laws of Germany upon which its probate and property laws were based. But, it is quite likely that later enacted specific laws govern this tech issue. Also, there is a choice of law issue. The jurisdiction that controls, in part, anyway, is likely to be that jurisdiction of the entity that controls the online digital asset, primarily and only secondarily to the jurisdiction where the decedent resides.
    – ohwilleke
    Jun 22, 2020 at 20:35

2 Answers 2


In the United Kingdom:

A person has no authority to access an online account of a deceased relative, unless this has been agreed with the operator of the website (etc). If a Power of Attorney over the deceased's financial affairs existed, this ceases upon death.

Using a person's login credentials without permission from the owner of the website would be a breach of the Computer Misuse Act 1990, as amended by Part 5 of the Police and Justice Act 2006, and Part 2 of the Serious Crime Act 2015.

Actus Reus

The offence is made out once a defendant has caused a computer, which would include his own computer, to perform a function with intent to secure access.

The access to the program or data which the accused intends to secure must be 'unauthorised' access.

Mens rea

There are two elements:

  • There must be knowledge that the intended access was unauthorised; and

  • There must have been an intention to secure access to any program or data held in a computer.

There has to be knowledge on the part of the offender that the access is unauthorised; mere recklessness is not sufficient. This covers not only hackers but also employees who deliberately exceed their authority and access parts of a system officially denied to them.

Crown Prosecution Service legal guidance

Additional note for accessing online banking and similar accounts:

A person who accessed a bank computer with the intention of transferring the deceased's funds to themself (such funds being the property of the estate, not the person) thus committing theft, would potentially be committing the further offence under Section 2 of the CMA of Unauthorised access with intent to commit or facilitate commission of further offences

If the person has a legitimate claim on the funds in the bank account, i.e. they are an executor or administrator of the estate, there is an established procedure to claim the funds from the bank. This does not include being given access to the deceased's accounts or statements, as these remain confidential. The bank will provide a closing balance at the date of death, together with a list of regular payments in/out of the account (those being parties the executor/administrator should advise of the death) together with a statement for any transactions after death ie during the period of executry of the estate.

  • I suspect you could probably find money laundering charges also.
    – richardb
    Jun 23, 2020 at 18:32
  • There has to be knowledge on the part of the offender that the access is unauthorized : Who is the offended part here? If the access is done to provide information to the local police, for example, and all the family agrees, what is the worst case scenario? I doubt a US based company will sue someone in UK for doing so. I know it may depends on the country/state, but in general, has anyone been in legal trouble for doing so? Do you know of any case study?
    – lepe
    Jul 6, 2020 at 4:22

In the US, it depends first on what the state law is, and second what platform policy is. There is a law, the Revised Fiduciary Access to Digital Assets Act, enacted in most states. Here is a summary of what that law does, and here is the version enacted by Washington. The Washington law makes an important distinction between the person's communications and their other digital assets. Both are stated in terms of the "custodian" (platform) disclosing information. In the case of a communication, you must have authority (e.g. be the personal representative) and prove that the person authorized access to the communications (or a court order, which would be granted only if reasonably necessary for administration of the estate). In the case of other digital assets (which would include lists of communications but not their contents), access is granted unless forbidden by the person: or, if required by the custodian. In other words, if you don't say one way or the other, only the content of communications are sealed, save for court order. But the platform itself can require proof that access is necessary to administer the estate.

Individual platforms may have provided something in their TOS regarding accessing a deceased's account, a number of which are summarized here p. 8 ff., but this was 6 years ago (before RUFADAA was circulated). None of these platforms addressed the matter of continuing to use an account with earlier permission, once the account holder dies. Instead, they simply say "we won't provide you with access to the account". The TOS probably allows the platform operators to block access in case of "suspicious activity". The Computer Fraud and Abuse Act does not say that permission to access an account is revoked upon death of an account holder, so if the person authorized you to access the account and did not revoke that authorization, you are authorized (eternally, or until the law or TOS changes). But each state has some such law, so there might be some "revocation on death" clause, somewhere. It may be contrary to a particular platform's TOS for a person other than the account owner to ever log in to the account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .