Is it a crime for my family to log into my accounts after I die?
This is general information, not legal advice — the answer genuinely depends on your state and the specifics, and you should not treat this as a green light or a red light without asking an attorney.
The federal law in play is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. Its core language criminalizes anyone who "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer" — and courts have read "protected computer" broadly enough to cover essentially any computer connected to the internet, which includes the servers behind any online account. Source
The open legal question is what "without authorization" means once the account holder has died and a platform's own terms of service (which every major platform bans password-sharing under) are the only thing defining "authorized." This is exactly the ambiguity Q7 in our first batch flagged and did not resolve: RUFADAA creates a lawful, formal request process aimed at the company, but simply typing in a known password is a different act entirely, and neither RUFADAA nor the CFAA's text directly says whether a grieving family member logging in with a password the deceased shared while alive commits a federal crime. In practice, prosecutions of family members for this specific scenario appear to be essentially unheard of — but "unheard of" is not the same as "not technically a violation," and the honest answer is that this is unsettled at the intersection of two different bodies of law.
What we could not verify: any case where a family member was actually prosecuted, under the CFAA or a state computer-crime statute, specifically for logging into a deceased relative's account with a password the deceased had given them. We looked; we did not find one. That absence of prosecutions is not proof the underlying legal risk doesn't exist.
← What happens to a domain name I own when I die?
→ Does listing my passwords in my will make them public record?
All forty-six questions