Giving an agency access without surrendering account ownership

Keep a client administrator able to manage each account, and invite the agency or link its manager account instead of sharing a password. For each system, record the task, minimum platform role, named client approver and client-side owner responsible for removing access.

In Google Ads, manager accounts and client-account ownership are distinct concepts. Before accepting a manager relationship, review the access request and confirm a client administrator remains able to manage the client account.

In Google Analytics, open Admin and use Account access management to grant access across the account, or Property access management to limit it to one property. Add the agency user at the narrowest level that supports the agreed task.

Google Analytics roles include Administrator, Editor, Marketer, Analyst, Viewer and None. Choose the least-permissive role that supports the task, and check the scope as well: account-level access can cover every site in that account, while property-level access applies to a specific property.

A Google Analytics account is the highest level and can hold multiple properties; users and billing are managed at the account level. A property represents a website or app, so check that the client retains control of the account itself, not merely access to a property.

After granting access, have the client administrator sign in and confirm they can still manage the account. Ask the agency to confirm its intended task works; if it does not, investigate the missing permission rather than increasing access automatically.

Where the Australian Privacy Principles apply, OAIC guidance on APP 3 limits collection of personal information. An agency may collect it only where reasonably necessary for, or directly related to, its functions or activities; an organisation may collect it only where reasonably necessary for its functions or activities. Sensitive information requires consent unless an exception applies, and information must be collected by lawful and fair means.

APP 6 limits use or disclosure of personal information to the purpose for which it was collected, unless an exception applies. Exceptions include the individual’s consent or a use or disclosure the individual would reasonably expect that is related to the primary purpose; for sensitive information, it must be directly related.

Review access after launch and at contract end. Remove agency users and manager links where appropriate, rotate exposed credentials, and check integrations or exports the agency set up.

Before and after removal, confirm the client administrator can still sign in and manage the account. Review every system on the access record, not just Google Ads.

Key Compliance and Access Management Facts