A marriage that lasted a decade leaves behind a shared technical estate. A family plan. A photo library that syncs both ways. A password vault holding two people’s logins. A thermostat that answers to two phones. A recovery email address that quietly controls most of it.

Most people can describe their finances more accurately than they can describe this. And when a separation starts, none of it partitions itself. It keeps running exactly as designed, which means two people who would not grant each other access today still have it.

Start With the Recovery Address, Not the Password List

Changing passwords feels like the obvious first move. It is the wrong first move.

Every account has a reset path, and that path almost always terminates at an email address or a phone number. If someone else controls either one, a new password buys you nothing. It can be reset before you finish working through the list.

Work from the bottom of the stack upward

Secure the primary email account first, then the phone number, then the second factor. Only after that does changing individual passwords accomplish anything durable.

Check what the recovery options currently are rather than what you remember configuring years ago. Old backup addresses and a spouse’s number sitting as a trusted device are extremely common, and nobody notices until it matters.

Family plans are single points of control

A family subscription, a shared storage plan, a carrier account. Whoever holds the organizer role can usually see device names, locations, purchase activity, and sometimes where messages are delivered. Being a member of the plan is not the same as administering it, and the difference is invisible day to day.

The devices nobody thinks to list

Smart speakers keep voice history. Doorbell cameras keep clips and a log of who viewed them. A car with a connected app reports where it has been and can often be unlocked remotely by anyone still paired to it.

These sit outside the mental category of “accounts” entirely, which is precisely why they survive an otherwise careful cleanup.

Looking at Their Accounts Is Not a Grey Area

This is where people who would never otherwise break a law break one.

California treats unauthorized access to a computer, computer system or data as a crime under Penal Code section 502. The section is long and it reaches a wide range of conduct, but the organizing idea stays constant throughout: access without permission.

Knowing the password is not the same as having permission

The most common misunderstanding in a separating household is that a password shared in 2019 is a standing invitation in 2026. It is not. Permission can be withdrawn, and the circumstances of a separation withdraw it in practice long before anyone says so out loud.

Reading a spouse’s email because you have always known the login. Signing into their cloud backup to look at photographs. Opening their messages on a device that still syncs. None of these are neutral acts, and the section carries civil exposure that exists independently of whether anything is ever prosecuted.

The evidence problem sits on top of the criminal one

Even where nothing is charged, material gathered this way tends to be useless. It arrives with an explanation attached, and the explanation is the story of how you obtained it.

Family judges notice that story. It becomes the subject of the hearing, displacing whatever the material was supposed to show.

Location Sharing and Trackers Are Two Different Problems

People collapse these into one worry. The law keeps them apart.

The tracking device rule is narrow and specific

Penal Code section 637.7 prohibits using an electronic tracking device to determine the location or movement of a person. It defines that device as something attached to a vehicle or other movable thing which reveals location by transmitting electronic signals, and a violation is a misdemeanor. The exception is consent from the registered owner, lessor or lessee of the vehicle.

That is the tag dropped into a glovebox or slipped into a bag. It is the clearest line in this whole area, and it gets crossed far more often than people admit.

Phone location sharing is a consent question instead

Ongoing location sharing between phones is a different animal. It normally lives inside an account both people could reach, which puts it back under the access rules rather than the tracker rule.

Switch it off deliberately, then check again a week later. These settings get re-enabled by software updates, by restoring a handset from a backup, and by sharing features that treat re-adding a member as routine housekeeping.

The Family Court Version of the Same Conduct

Criminal exposure is not the only exposure worth understanding.

Family Code section 6320 permits an order against conduct that disturbs the peace of the other party, which the section defines as conduct destroying their mental or emotional calm. It states this may be committed indirectly, by any method, including through internet-connected devices, and it names coercive control as a pattern that qualifies.

That language does real work in modern cases. Sustained monitoring, account interference and device-mediated contact all sit comfortably inside it, and nothing resembling violence is required.

Do the Audit Once, Properly, and Keep the Notes

Write down every account, then record who can reach it, who administers it, and where its recovery path leads. It is tedious and it costs you an evening.

Note the dates as you go. Knowing that a password changed on a particular Tuesday, or that a device was removed from a plan in March, converts a vague dispute into something checkable.

Keep that document. When a question surfaces months later about who could see what and when, an Orange County representation for divorce will be reconstructing exactly this from whatever records exist, and having it assembled in advance is worth more than any single setting you might change tonight.