What to Check Before a Contractor Grants Ad Account Access

Verify the account before sending an invitation

Identify the correct legal or business account, account number, billing profile and current administrators. If multiple locations or brands share a login, map which campaigns and assets belong to the contractor. Confirm the email address receiving an invitation through a known channel; a typo can expose data to the wrong person.

Google Ads provides user access levels and security controls. Use the platform’s current invitation flow and confirm what each role can view or change. The exact role names and limits can change, so check the actual account interface and current documentation at the time access is granted.

Apply the least access needed

Match the permission to the job. A person preparing a review may need read access; campaign setup or ongoing management may require edit permissions. Administrative control, billing authority and ownership are separate responsibilities. Avoid granting an admin role by habit when a narrower role supports the work.

Google recommends regular review of users and removal of people who no longer work on the account. Keep the business’s owner access and recovery controls with authorized staff. Do not send passwords, authentication codes or recovery links in a shared chat or email thread.

Agree on who can change what

Document the amount the agency may spend, which campaign settings need advance approval, how creative is approved and who can pause delivery. Define whether changes to budgets, service areas, billing, tracking, phone routing or landing pages require the owner’s sign-off. For Parallax, critical budget and outbound-message changes should be owner-approved under the agreed scope.

Keep a simple change log: date, account, campaign, reason, expected effect, approver and verification. Google Ads change history can show account, campaign and ad-group changes, including changes made through automated rules or APIs. Use it as an audit aid, not as a substitute for business approval.

Protect billing and personal data

Confirm who receives invoices and whose payment method funds media. A campaign manager should not change billing permissions or payment settings unless the contract and account authorization explicitly assign that task. Verify the business’s own spending limit and billing notifications.

Limit access to customer lists, lead exports and conversion data based on need. Review what is uploaded to an ad platform, the business’s consent basis and privacy disclosures before sharing identifiers. If the provider does not need a data export, do not send one. Use approved account tools and secure transfer methods when data sharing is authorized.

Test access and preserve a recovery path

After the invitation is accepted, confirm the provider can reach only the intended account and perform the scoped task. Verify the business owner can still sign in, manage users and contact platform support. Keep two authorized business contacts where feasible so account access does not depend on a single former employee.

Do not turn off multifactor authentication to make a vendor handoff easier. If an admin loses access, use the platform’s official recovery process. Store backup codes securely under the business’s existing security procedure, not in a marketing document.

Plan offboarding before onboarding

Write down who removes access, how final assets and reports are delivered, what happens to manager-account links and which tracking or billing items need review. On offboarding, remove the former vendor’s role promptly, check remaining users and verify the contractor retains campaign history and ownership.

If the business changes agencies, keep the account stable while the new provider audits it. Do not delete campaigns or tracking settings just to make a handoff clean. Review the existing structure, change history and permissions, then document proposed modifications for approval.

A permission checklist

• Confirm account ID, business owner and billing contact.
• Verify invitee identity and use named platform access, not shared passwords.
• Select the narrowest role that permits the contracted work.
• Keep admin, recovery, payment and user-management controls with authorized business staff.
• Document budget cap and actions needing written approval.
• Review access periodically and remove former users.
• Record offboarding steps and secure transfer of approved deliverables.

When access is not ready

Do not invite a provider into an account if the owner cannot identify who controls it, if there is a suspicious invite, or if requested permissions exceed the agreed task. Resolve ownership and account-security questions first. Ask the platform’s support for help when the authorized administrator cannot access settings.

A managed service can review, configure and monitor campaigns within an approved permission scope; it should not require the business to surrender account ownership. Confirm the access and approval model before starting any paid work.