What account access should you give a marketing agency?

The question is usually asked as a question of degree. How much access, and how much could they break with it. The degree is the part that is easy to change.

Google states the rule plainly in its own documentation. A manager account that creates a new client account becomes the owner of that account automatically. A manager account that links to an account the firm already created does not take ownership unless the firm turns it on. Two routes to the same campaigns, run by the same agency. One leaves a UK practice holding its own advertising account and one does not, and nothing on the screen announces which just happened.

Google Ads publishes five access levels and a firm can change any of them in a minute. Ownership is settled once and invisibly, usually by whoever was free that morning, and it is the half that still matters in three years.

Access is the small decision. Ownership is the large one.

A Google Ads client account can have only one owner, and ownership follows whoever created the account. Google's page on ownership of client accounts sets out what an owner manager may then do: invite users with administrative access, remove users, grant or revoke administrative access, accept or decline link requests from other managers, and transfer ownership elsewhere.

Every item on that list is a decision about who controls the firm's advertising, and none of it is about advertising. A practice that did not create the account holds none of those rights.

Done first, the correction costs nothing. Google's guidance on linking accounts to a manager account notes that a linked account is unchanged and its history stays intact. The firm opens the account and the agency links to it. Nothing about the work changes.

What a practice holds, and what it hands over

Nothing here argues for withholding access. An agency kept at arm's length produces slower work and turns a partner into a bottleneck. The distinction worth drawing is between the seat and the room.

Account level and property level are different grants

A role granted at Google Analytics account level is inherited by every property inside that account. Google's access and data restriction management guidance states the inheritance directly, and its account structure page describes an Analytics account as owning the data for a single legal entity.

For a UK practice running one website that is a distinction without a difference. For a practice with a recruitment arm or an old site nobody retired, it is the difference between granting one property and granting the lot. Google lists five roles, and notes that an Administrator can grant full permissions to any user including themselves. Administrator is not the top of a scale of usefulness. It is the right to make the arrangement permanent.

Your own certification already governs this

Cyber Essentials treats an agency login as exactly what it is, a user account created for somebody outside the firm. The requirements for IT infrastructure published by the UK National Cyber Security Centre ask an organisation to have a process to create and approve user accounts, to remove or disable them when they are no longer required, to use separate accounts for administrative activity, and to authenticate to cloud services with multi-factor authentication.

Hold that against what most firms actually do, which is email a password. A shared credential satisfies none of it: you cannot withdraw a password four people know from the one who has left, and multi-factor authentication cannot be attached to a login with nobody behind it. An account per named person is most of the requirement.

The revocation drill

Every one of these is answerable from inside your own accounts in under half an hour, without telling anybody.

Keep the right to grant rights

Of the five access levels Google Ads publishes, only Admin can change who else has access. The access levels page puts Standard below it, able to edit campaigns and run billing reports. Below that sit Read only and Email only. Billing is a separate scope for payments.

The working rule is short: Standard for the people doing the work, and Admin for one named person at the firm. An agency that cannot work at Standard should be able to name the task that requires more.

When not to grant anything yet

A firm cannot delegate a right it does not hold.

Two situations are worth stopping for. Where nobody at the practice holds an administrative seat on an asset, granting access adds a second party with no control, so the firm's own seat comes first. And where nobody can say who approves an account being created, nobody owns removing it, which is how logins outlive the engagements that needed them.

The length of the engagement changes none of this. The access a first piece of work needs is set by the deliverable rather than by the contract, which is a separate decision covered in whether a paid pilot beats starting on a retainer.

We are paid by the agency, so a page that slows an introduction down costs us money. What we look at before recommending anybody is set out for accountancy practices, recruitment agencies, tax advisory and financial advice firms.