Who owns your website, domain, ad accounts and data? An ownership checklist

A familiar story: a business changes agency, and the old agency “can’t find” the login for the domain. Or a marketing manager leaves, and the Instagram account and ad account were set up on their personal email. Recovering access can take weeks, and sometimes the history (reviews, ad data, followers) is lost for good.

The fix costs almost nothing if you do it before there’s a problem.

The principle

For every critical account:

1. Owned by the business: registered to a business email address on your own domain (not someone’s personal Gmail), and billed to the business.
2. At least two admins from inside the company. Google’s own help for Google Ads notes that with only one admin, you may lose access to things like tag management if that person becomes unavailable.
3. Partners get partner access: agencies and freelancers are added as users or partners with the lowest level they need, never as owners.
4. Written down: in an access register that someone reviews regularly.

The accounts to check

Access levels in plain terms

Google Ads, for example, has Admin, Standard, Read-only, Billing and Email-only access. Only admins can manage users and accept or reject manager-account links. Give agencies Standard access or link their manager account, and keep Admin inside the business.

Google Business Profile has owners (including one primary owner) and managers. Keep the primary owner inside the business.

When someone leaves or a supplier changes

The same day:

1. Remove their access from every account on the register.
2. Change shared passwords, and move any accounts registered to their email.
3. Check two-factor authentication devices: is a former employee’s phone the only second factor?
4. Download anything you need from their personal workspace before it’s deleted.

When you change agency, ask for a written handover: list of accounts, access removed, and any assets they created (creative files, landing pages, tracking setups).

Common traps

• Domain registered by the web designer in their name. Transfer it to your own registrar account.
• Ad account created inside the agency’s business portfolio. You may be able to request access but not ownership. Create ad accounts in your own portfolio and give the agency partner access.
• Website on an agency’s hosting plan with no export. Ask how you’d move it if you left. See what a website should cost.
• Two-factor codes going to one person’s phone. Add a second admin with their own 2FA, or use a shared authenticator managed by the business.
• Auto-renew off on the domain. An expired domain takes your website and email down together.

Frequently asked questions

Our agency set everything up. Is it rude to ask for ownership?

No. Reputable agencies expect it, and many recommend it. Ask them to add your business as owner and themselves as partners.

What if we can’t recover an account?

Each platform has a recovery process (domain registrar support, Google Business Profile ownership request, Meta business support). It’s slow, so start with the register before you need it.

How often should we review access?

At least every six months, plus whenever someone leaves or a supplier changes.

If you’d like help auditing and fixing account ownership across your tools, that’s part of our tech stack service.