Karen Williams fought Facebook over photos and other digital assets of her late son, Loren.


A grieving Oregon mother who battled Facebook for full access to her deceased son's account has been pushing for years for something that would prevent others from losing photos, messages and other memories - as she did.

"Everybody's going to face this kind of a situation at some point in their lives," says Karen Williams, whose 22-year-old son, Loren, died in a 2005 motorcycle accident.

The Oregon Legislature responded and took up the cause recently with a proposal that would have made it easier for loved ones to access the "digital assets" of the deceased, only to be turned back by pressure from the tech industry.

The industry argued that both a 1986 federal law and voluntary terms-of-service agreements prohibit companies from sharing a person's information - even if such a request were included in a last will and testament.

Lobbyists agree the Stored Communications Act is woefully out of date but say that until it's changed, laws passed at the state level could be unconstitutional.

"Everybody wants to do the right thing, but the hard legal reality is the federal communications act," said Jim Hawley, a vice president at TechNet, an industry group that represents companies including Google and Microsoft.

Oregon lawmakers moved ahead anyway with a proposal that would have given "digital assets" - everything from photos and messages stored online to intellectual property and banking information - the same treatment as material property for estate purposes.

"It's time for us to really look at what we can do now," Democratic Sen. Floyd Prozanski said after hearing Williams testify last month.

Two weeks later, however, language in the bill that would have covered social-media accounts, from Facebook to Flikr, was stripped as tech lobbyists said the federal law and company privacy policies trumped anything that the bill would have included.

"I recognize the emotional toll these types of decisions can have on a family who's lost a loved one," Prozanski said. "But some of these issues may have to be addressed when we have more information than we currently have."

Still, the problem persists and discussions on the issue are gaining momentum. As unlikely as such a case might be, even if a person willingly gives over login and password information to someone who is authorized to access a given digital account, it would violate most terms-of-service agreements and both people could be charged with cybercrimes and face civil action from Internet companies under current law.

Five states have digital-assets laws, which vary widely. This group includes Oklahoma, which passed a law two years ago allowing estate lawyers to access digital assets, even social-media accounts.

"There is some question if laws like the one we passed in Oklahoma would stand up to a challenge by Facebook and Gmail saying their terms-of-service agreements supersede laws like this one and the one being discussed in Oregon," said Ryan Kiesel, an ex-legislator who wrote the law.

Several other states, including Nebraska, are also considering proposals. And the Uniform Law Commission, a nonprofit, nonpartisan group that writes model legislation for states to help standardize laws on a wide array of topics, is examining the issue.

Proponents say the need is clear. Without clarity or direction, the digital information left behind by a deceased person can spark emotional legal battles, pitting big business against devastated families. And as more and more memories are being stored online, new tools are necessary to make sure loved ones can easily access personal details that could be lost forever.

"If this were a box of letters under his bed, no one would have thought twice," Williams said.

Months after the death of her firstborn son, who was away at college in Arizona, Williams found comfort in his Facebook page. There, she was able to click through photos and letters that helped ease the pain of her loss - for two hours.

She learned of the page from his friends and wanted access to his memories to keep them from being deleted, which was Facebook's policy at the time. Unaware of Internet privacy regulations, she reached out to Facebook for help. As she waited for a response, one of his friends provided a tip that helped her discover his password. "It was like a gift," she said.

Shortly after, however, the site's administrators changed the password, citing company policy in denying her. Williams sued and won, but she never received the full access she sought. Eventually, the account was taken down. In the end, she gained little more than a symbolic victory and a role as champion of a cause that didn't exist before the digital age.

Kiesel, the former Oklahoma lawmaker, says the federal government will ultimately need to provide greater uniformity by law.

Congress, however, has no current plans to take up the matter, according to the office of Sen. Mark Pryor, an Arkansas Democrat who heads the Senate Commerce subcommittee on communications and technology. Also, a bill aimed at modernizing the Stored Communications Act failed in the House Judiciary Committee last year.

Under current law, Internet companies that provide storage for digital assets are prohibited from disclosing account information, even to families, without a court order, which can be costly and difficult to obtain.

Even then, there are no guarantees. Facebook, for example, citing its terms-of-service agreement, won't provide access, even if a judge orders it to do so.

Facebook will not comment on pending legislation or specific cases other than to defer to its service agreement, which states, in part, "We may access, preserve and share your information in response to a legal request (like a search warrant, court order or subpoena) if we have a good faith belief that the law requires us to do so."

Along these lines, TechNet testified against the Oregon proposal, saying that requiring online companies to provide access could subject them to federal criminal penalties.

The pending Oregon legislation now covers only digital assets of commercial or financial value, such as online banking information.

"It's absolutely devastating," Williams said.

Since she began her crusade in 2007, the social-media landscape has changed considerably, but there is still no industry standard. Where Facebook once deleted the accounts of deceased users, for example, pages can now be memorialized for public view.


Estate-planning attorney James Lamm, who writes the blog "Digital Passing," advises people to plan ahead for their virtual afterlives. Your best bet is to make sure valuable memories and intellectual property are stored somewhere besides a social-media account - so back up your photos on a USB flash drive.

Still, given the prevalence of social media in today's world, Lamm advises these three steps as a sort of digital-estate planning guide to help ensure your wishes are carried out - even though, he says, with the law as it stands currently, there are no guarantees.

• KEEP A LIST: Make a list of all your digital accounts, including social media, email, online banking, investment, gaming and any other virtual profile you can think of. Include your login information, such as user names and passwords, and encryption data.

• PUT SOMEONE IN CHARGE: Tell estate planners where to find that list and give them explicit instructions for how you want the information handled. Do they hit the delete button? Or do they notify the company to memorialize your site?

Don't ask this decision-maker to commit a crime by logging in to your accounts, but if the law changes in the future, this step could make it more likely your wishes are fulfilled.

• WILL POWER: If you have a will, it's best to include your digital assets there. Some online information has real financial value, and it's good to cover all your assets. A McAffee survey found that on average Americans believe the financial and emotional value of their digital assets are about $55,000.