Access and ownership
Who should own your marketing accounts
The accounts your marketing runs on are business assets. Most of the damage we see is not bad marketing, it is a business that cannot get into its own listing, ad account or page.
Should my agency own my marketing accounts?
No. Every major platform separates ownership from access, and the business should hold ownership while anyone helping holds a delegated role that can be granted and removed.
In practice that means the business creates the account under its own email domain, becomes the owner or primary administrator, and then adds the agency as a manager, partner or admin through the platform's own delegation system. Nobody shares a password, because a shared password cannot be revoked without locking everyone out.
The test is simple: if the relationship ended tomorrow, could the business remove the agency's access in five minutes and keep everything? If the answer is no, the setup is wrong, whatever the contract says.
The accounts are the asset, not the agency that manages them
A business's Google Business Profile, ad accounts, social pages and analytics are where its history, its reviews, its audiences and its learning live. Losing access to them is not an inconvenience, it is losing years of accumulated position.
It is worth being specific about what is lost, because the abstract version does not motivate anybody. A Google Business Profile carries every review the business ever earned, and reviews do not transfer. An ad account carries conversion history that the platform's bidding has learned from, and a new account starts that learning again. A Facebook page carries followers. A YouTube channel carries subscribers and watch history. An analytics property carries every year of data you would need to tell whether anything is working.
Read the full breakdown: The accounts are the asset, not the agency that manages themHide the full breakdown: The accounts are the asset, not the agency that manages them
None of that is recoverable by starting again, and all of it is at risk when the account sits in somebody else's name. The situations we see most often are not dramatic: an agency relationship ends on ordinary terms and the handover drags on for months, or an employee who set everything up on their personal account leaves, or a freelancer becomes unreachable. The outcome is the same either way.
Every platform in this guide has already solved this. Each one separates who owns an account from who can work in it, precisely so a business can bring people in and let them go without disruption. The problem is almost never that the platform lacks the feature. It is that setup happened quickly, under whichever account was signed in at the time, and nobody went back.
The second half of the problem is passwords. Sharing a login feels like the easy answer and it quietly removes every protection the platform built. You cannot see who did what, you cannot revoke one person's access, two factor authentication stops working the way it should, and the account becomes a single point of failure held together by a message in someone's inbox.
Four rules that hold on every platform
First, create accounts under the business's own email domain, on addresses the business controls. Not a personal address belonging to the owner, which becomes a problem when they change it, and never an agency address. Whoever controls the inbox behind an account can usually recover the account, which makes that inbox the real ownership record regardless of what any other screen says.
Second, the business takes the highest role the platform offers, and keeps it. Primary owner on Google, administrator on Apple, super admin on LinkedIn, full control on a Meta business portfolio. Whatever it is called, the business holds it and never hands over the only copy of it.
Read the full breakdown: Four rules that hold on every platformHide the full breakdown: Four rules that hold on every platform
Third, add helpers through delegation, not by sharing credentials. Every platform here has a way to invite an outside party as a partner, manager or admin, and every one of those roles can be removed without touching anything else. On the platforms that distinguish between adding a person and adding an organisation, add the organisation, because then the agency's staff turnover is the agency's problem rather than yours.
Fourth, have two people at the business with the top role wherever the platform allows it. A single administrator is a single point of failure, and the failure arrives at the worst time: somebody leaves on bad terms, loses a phone with the authenticator on it, or simply cannot be reached. Two is not paranoia, it is the difference between an annoyance and a recovery process that takes weeks.
How delegation actually works on each platform
The principle is the same everywhere. The mechanics are not, and the specific mistake that costs you is different on each one. These are the six that matter for most local businesses.
Google Business Profile
The business's Google account is the primary owner. Anyone helping is added under people and access as a manager, or as an owner at most. Agencies that manage several profiles should be added as a registered organisation rather than as individual email addresses, so staff changes at the agency do not require touching the profile.
- The mistake that costs the most: letting an agency verify the profile under its own account. That makes the agency the owner, and getting it back means a formal ownership request and a wait.
- A newly added manager goes through a waiting period before gaining full powers, so start handovers before you need them rather than on the last day.
- Reviews live on the profile and cannot be moved. This is the account where losing access is least recoverable.
Meta, meaning Facebook and Instagram
Meta's model has three layers and confusing them is the usual source of trouble. Pages and business portfolios can only be created from a real person's personal profile, so somebody's personal account is always involved. The business portfolio is the container that should own the page, the Instagram professional account and the ad account, and the email on that portfolio should be the business's own domain.
- Never create a second personal Facebook profile for the business. One account per person is Meta's rule and breaking it risks everything attached to it.
- Add the agency as a partner, not as a person. Partner access can be revoked in one action and does not depend on an individual staying employed.
- Being added to a portfolio grants nothing on its own. Assets have to be assigned separately, which is the step people skip and then wonder why access does not work.
- Put at least two people from the business on full control of the portfolio.
LinkedIn Company Page
A LinkedIn Page is created from a personal profile and administered through admin roles. Super admin is the top role and it can add and remove other admins, which makes it the one that matters. The business keeps super admin, always, and the agency is added at whatever level it needs.
- A page with a single super admin is a time bomb. If that person leaves or loses their account, the business loses control of its page.
- Two super admins from the business is the minimum. Add the second one the same day you create the page, not later.
- If nobody can get in, LinkedIn has a route to request admin access to an existing page. It works, but it is slower than keeping a spare admin.
See the remaining steps: How delegation actually works on each platformHide the remaining steps: How delegation actually works on each platform
YouTube
A business channel should be a Brand Account rather than a channel attached to somebody's personal Google account, because a Brand Account can have its ownership and permissions managed separately from the person who created it. Access is then granted through channel permissions inside YouTube Studio, which is the modern route and the one that avoids password sharing entirely.
- Studio permissions let you add editors and managers by email without anyone ever seeing the password.
- Transferring primary ownership of a channel involves a delay by design, so do not leave it to the handover week.
- Set the audience setting deliberately during setup. Getting it wrong either disables features you need or creates a legal problem around content directed at children.
Pinterest
Pinterest removed the old model where a business profile hung off a personal login. Every business account is now a standalone login with its own unique email address, which actually makes ownership cleaner. Agency access goes through Pinterest Business Manager as a partner relationship.
- Create the account on a business domain address that the business controls, not on a personal one.
- Claim the website from the account. Claiming ties the domain to the account and is part of what proves the relationship later.
- Old guides describing linked business accounts are out of date. If somebody is following one, they are working from a version of Pinterest that no longer exists.
Apple Business Connect
Apple's rule is blunt and easy to get wrong: the first account to sign in and register becomes the administrator. That has to be the business's own Apple Account. Agencies register separately as third party partners and are then granted access to the locations they manage.
- Do not register on an agency's Apple Account for convenience during setup. There is no quick fix afterwards.
- Verification runs on a deadline from the moment you register, so gather the licence or utility bill before starting rather than after.
- Verification itself can be delegated to somebody at the business if the person doing the setup is not the right person to confirm identity.
Across all six, the pattern to check is the same. Open the people or access screen. Confirm the business holds the top role. Confirm at least one other person at the business holds it too. Confirm every external party is there by delegation and not because they know the password.
The role the business must keep on each platform
The names differ and that is most of why this gets muddled. Here is the same idea expressed in each platform's vocabulary.
| Platform | The role the business keeps | How an agency should be added |
|---|---|---|
| Google Business Profile | Primary owner | Manager, ideally through a registered organisation |
| Meta business portfolio | Full control, on at least two people | Partner, with assets assigned explicitly |
| LinkedIn Page | Super admin, on at least two people | Admin at the level the work needs |
| YouTube | Owner of the Brand Account | Studio channel permissions, by email |
| The standalone business account login | Business Manager partner | |
| Apple Business Connect | Administrator, registered first | Third party partner, granted per location |
If any row of this table does not describe your setup, it is worth fixing while the relationship is good. Every one of these changes is straightforward to make with cooperation and slow to force without it.
A thirty minute audit of your own accounts
You do not need anybody's permission to run this, and it tends to surprise people. Work through it and write down what you find.
- Open your Google Business Profile's people and access screen. Is your business the primary owner, or is somebody else?
- Open your Meta business portfolio's people and partners screens. Does anyone from the business have full control, and is the agency there as a partner or as a person?
- Open your LinkedIn Page admin list. How many super admins are there, and do any of them work for you?
- Check whether your YouTube channel is a Brand Account or attached to an individual's personal Google account.
- Check which email address is on each account, and confirm you can receive mail at it today.
See the full checklist: A thirty minute audit of your own accountsHide the full checklist: A thirty minute audit of your own accounts
- List every account where the only way in is a shared password, and treat each one as a task rather than a note.
- Confirm there is a second person at the business with top level access to each platform.
- Store every account and recovery detail in the business's own password manager, owned by the business.
The most common finding is not malice. It is one account created in a hurry years ago under whoever was logged in, and never revisited. Fixing it takes an afternoon while everyone is still on good terms.
If we disappeared tomorrow, you would keep every account, every review and every audience. That is not generosity, it is how the platforms are designed to work.
Not sure what you actually own?
We audit account access as part of onboarding, and we will tell you what we find whether or not you work with us. Every account we touch stays in the client's name.
Straight answers.
My agency set everything up in their own accounts. How bad is that?
It is fixable, and it is worth fixing now rather than during a handover. Most platforms have a route to transfer ownership or request access, and a cooperative agency can usually sort it in a day.
The risk is not that today's agency behaves badly. It is that the arrangement makes an ordinary ending expensive, and it gives any future disagreement a hostage. Ask for the change while nothing is wrong, and treat reluctance as information.
Is it safe to give an agency admin access?
Yes, when it is delegated access rather than shared credentials. A delegated role is visible, attributable, and removable in one action, and it leaves the platform's own security intact.
What is not safe is sharing a password. It defeats two factor authentication, hides who did what, and means revoking one person's access requires changing the password on everyone. If somebody asks for your login rather than an invitation, ask why.
What happens to my reviews and followers if I change agency?
Nothing, provided the accounts are in your name. Reviews sit on your Google Business Profile, followers sit on your pages, and subscribers sit on your channel. Change who has access and all of it stays exactly where it is.
If the accounts are in the agency's name, the honest answer is that it depends entirely on their cooperation. That asymmetry is the whole argument for setting it up properly at the start.
Why do I need two administrators?
Because one is a single point of failure, and the failure is rarely convenient. People leave, lose phones with authenticator apps on them, change email addresses, or become unreachable.
Recovering a platform account with no reachable administrator is a support process measured in weeks and it does not always succeed. Adding a second person takes about a minute.
Can I just use one password manager and share the logins?
A password manager is a genuine improvement on a spreadsheet or a message thread, and every business should have one. But it solves storage, not permissions.
Use it to hold the business's own account credentials and recovery codes. Use the platforms' own delegation for everyone else, so that removing somebody is one click rather than a password rotation across every account they touched.
Where this comes from.
Primary documentation and published research behind the guidance on this page.
- Google Business Profile Help: Add or claim your Business Profile (opens in a new tab)
- LinkedIn Help: Page admin roles and permissions (opens in a new tab)What a super admin can do that other roles cannot, including removing other admins.
- LinkedIn Help: Request admin access to a LinkedIn Page (opens in a new tab)The recovery route when nobody at the business can get into their own Page.
- YouTube Creators: channel setup and Brand Accounts (opens in a new tab)
- Pinterest Help: Get a business account (opens in a new tab)Pinterest business accounts are now standalone logins. Linked business accounts were removed.
- Apple Business Connect User Guide (opens in a new tab)Apple's own documentation for registration, verification and place cards.
Talk to the team
A short call, a look at how the business currently shows up, and a straight answer on what we would do first.