Give an agency ad access without giving away the account

The email arrives the day after you say yes: “Can you send over your Google Ads login?” Or a link request from a manager account you have never heard of, or a promise to “spin up a fresh ad account on our side.”

Any of those can be fine. Any of them can also leave you, a year later, asking permission to see your own campaigns. The difference is a few settings that take ten minutes on day one and, in our experience, weeks to untangle later.

How someone asks for access is also a cheap test of their expertise. A specialist asks for a specific level on a specific account and says why.

Four questions to settle before you click invite

Get the answers in an email:

• Whose name is the account in? Your business, with a business email, not the agency’s or a staff member’s personal Gmail.
• Who pays the platform? Your card on your own payments profile, or the agency’s invoice. That affects whose name Google shows in the disclosure on your ads, and what has to move when you leave.
• What level do they need, and why? “Admin, because that is what we always ask for” is not a reason.
• What happens to access when the contract ends? Who removes whom, and how fast. If that lands in a contract, have your own attorney read it; nothing here is legal advice.

Never send a password. Google and Meta give each person their own sign-in, so you can remove one without changing the locks.

Google Ads: a user invite and a manager link are different doors

To invite someone to Google Ads, open Admin, then Access and security, then the plus button, and pick one of five levels, from Email-only up to Admin.

Level	What it can do	Who it suits
Email-only	Notification emails and reports	Someone who only reads the reports
Billing	Billing and payment methods, not campaigns	Your bookkeeper
Read-only	See campaigns and run reports	An auditor
Standard	Edit campaigns, plus Read-only	Whoever runs your ads
Admin	Everything, including users and links	You, plus one colleague

Standard cannot give anyone more than Email-only access, change access levels, add or remove product links, accept or reject manager link requests, or unlink a manager. It can run the ads but cannot lock you out. If a setup job needs Admin, such as linking Analytics to import conversions, grant it for that job, then step it back. With a single admin, the account can lose control of its tracking tags if that one person leaves or loses their login, so keep two admins of your own.

Agencies with many clients usually send a link request from their manager account instead. Accepting it lets that manager’s admins run your campaigns, which is normal.

Ownership is a separate switch, and it is the one to leave off. With it, the manager’s admins “can also edit user access, managers, and product links within your account,” which includes removing your own admins. Two details:

• Ownership travels upward. Any company whose manager account sits above the agency’s owns your account too.
• A manager that creates an account owns it automatically. Linking an existing account gives no ownership unless you turn it on, so create the account yourself, then accept their link.

Turn it on “if and only if” a manager needs those privileges, in Google’s words, and running ads alone does not. Billing is the exception: when monthly invoicing or a credit line runs through a manager account, Google requires that manager to have ownership, so an agency that bills you through its manager account may ask for it. One more reason to keep billing on your own payments profile.

Keep the payments profile in your name

The payments profile is the business Google bills, and advertiser verification is tied to it: the verified name and location appear in the disclosure on your ads and in Google’s public ad library, the Ads Transparency Center. Changing it later is a billing transfer (“Change who pays”), after which you complete advertiser verification again and any promotional credit is neither transferred nor refunded. If the agency’s manager pays on monthly invoicing, unlinking it stops your ads, so move billing first.

Google’s third-party policy also requires agencies to hand over your customer ID on request and, whenever they share what you spent, to report the exact amount Google charged, without their fee mixed in. A good agency says so before you ask.

Meta: add a partner, keep the assets

On Meta, the clean setup is your own business portfolio holding your ad account, Facebook page and Instagram account. The agency gives you its own portfolio ID, and you add it as a partner under Settings, then Users, then Partners.

Then pick the assets and the level. Partial access covers tasks such as managing ads or answering messages, and Meta says even a partner with full control cannot share your asset with another business.

The trap is where the ad account is born: Meta says an ad account created in a business portfolio “will permanently be a part of that portfolio” and cannot be transferred out, so one born in the agency’s portfolio stays there. Create it in yours, then share it. If an agency asks to add your existing ad account to its portfolio, decline and ask for a request to share it instead, because adding an existing account “may permanently move it” into their portfolio. That is how our Meta ads work is set up.

Anyone you add to your portfolio, such as a freelancer on a short job, can get temporary access, from 3 to 75 days, removed automatically at the end. It is basic access only, so in the same invite pick the ad account and page they work on.

Business Profile: you stay owner, they become manager

Business Profile managers have mostly the same access as owners, except that they cannot add or remove users or remove the profile. So manager is the right role for anyone working on your Business Profile, while you stay primary owner.

Analytics and Search Console: read first, more later

At the audit stage, nobody needs to change anything. Google’s guide to hiring someone for SEO says that if one offers an audit, “only grant read access to Search Console (at this stage, don’t grant them write access).” In practice that means a Restricted user. Full user, which Google describes as able to “take some actions,” can wait until you hire them, and owner stays with you.

We would apply the same rule to Analytics, where the Viewer role shows settings and data without changing settings. If you would rather the agency not see your sales figures, Analytics can hide revenue from that user with the No Revenue Metrics setting, though it may not hold if their access comes through a linked product such as Google Ads. After you hire them, Marketer or Editor covers setting up key events; Administrator stays with you.

In Search Console, someone who verified as owner by leaving a file or code snippet on your site (Google calls it a verification token) can let themselves back in through it. When you remove the user, Search Console lists that token; delete it from your site too.

What to do this month

Whether you are hiring soon or already signed:

• Confirm two people from your business hold Admin in Google Ads.
• Check the Managers tab for a manager with ownership. Only the agency can switch ownership off, so ask them. Unlinking removes the manager entirely, so move billing first if they pay your invoice.
• Confirm the payments profile is in your business’s legal name, with your card.
• Confirm your Meta ad account and page live in your own portfolio, with the agency under Partners.
• Make sure you are primary owner of the Business Profile and Administrator on Analytics.

When we run Google Ads, the accounts stay in your name and we work in them with the access you give us. For the free plan, tell us which platforms you advertise on and who set each one up. Nobody needs a login for it: you check the list above in your own accounts, with us walking through it on the free consult if you like, and we tell you which fix to make first.