Quick summary
Your business should retain Administrator access to its own Google Analytics account, even when a web designer or marketing agency manages it. Agencies should use their own logins rather than sharing passwords, and the same approach should apply to Search Console and Google Tag Manager.
Most businesses know that Google Analytics has been added to their website. Far fewer know who actually controls it.
The account may have been created by the web designer who built the site, an SEO company, a marketing assistant or somebody who left the business years ago. As long as the reports keep working, nobody gives it much thought.
The problem usually appears when the business changes agency.
You ask the new provider to check your website traffic, only to discover that nobody in the company can access the account. Perhaps the previous agency is the only administrator. In some cases, the website has been added to an Analytics account containing dozens of that agency’s other clients.
It is avoidable, but only if the account is set up sensibly from the beginning.
Should your business own its Google Analytics account?
Your business should retain control of the Google Analytics setup connected to its website.
That does not mean you need to understand every report or manage the account yourself. Your web designer, SEO consultant or marketing agency can still set it up and look after it for you.
The important part is that someone within your business has Administrator access using an email address the business controls.
An agency should be given access through its own Google account. It should not be the only party capable of adding users, changing permissions or removing access.
This is less about distrusting agencies and more about good housekeeping. Staff leave, agencies close and working relationships change. Your access to years of website data should not depend entirely on a single external supplier.
Is it wrong for an agency to create the account?
Not necessarily.
Many clients ask their web designer or marketing agency to handle the entire setup. That is perfectly reasonable, especially when the client does not feel confident using Google’s several platforms.
An agency can create and configure the Analytics account on the client’s behalf. The problem is not who clicks the button to create it. The problem is how ownership and access are arranged afterwards.
A sensible agency will ensure the client has administrative access and that the website is not trapped within a larger account controlled solely by the agency.
Saying that any agency-created account is legally wrong would be too simplistic. Data protection responsibilities depend on how information is collected, used and shared. However, keeping a client’s website data in an account the client cannot control is poor practice and can create unneeded complications.
Understanding the different accounts
Part of the confusion comes from Google’s terminology. There are several layers involved, and people often use the word “account” to describe all of them.
A Google Account is the login you use to access Google services. It is usually connected to an email address.
A Google Analytics account is the main container within Analytics.
Inside that account are properties. A GA4 property normally represents a particular website or app.
The property contains a data stream. This is the connection through which information from the website reaches Google Analytics.
Your business does not need to share a Google login with its agency. Instead, different people can be added as users and given the access level they require.
You can also use an existing company email address for a Google Account. You do not have to create a new Gmail address solely for Analytics.
The problem with putting every client in one agency account
Google allows one Analytics account to contain multiple properties. That can make it tempting for an agency to create a single company account and place every client website inside it.
It is convenient for the agency, but it can make things awkward for the client.
The client may be given access to their individual property, but the surrounding account still belongs to the agency. Moving the property later may be possible, although it requires the correct permissions and can become more complicated where different organisations and integrations are involved.
There is also a basic organisational issue. The website and its data relate to the client’s business, not the agency’s.
A separate Analytics account for each client creates a cleaner boundary. The client holds administrative access, while each supplier is given access to the account or property as required.
If the client changes agency, the old agency can be removed, and the new one added. The property, tracking code and historical reports remain with the business.
Why shared passwords are a bad idea
A client should not give an agency the password to its Google account.
There is no need to do this. Google Analytics allows individual users to be added using their own email addresses.
Sharing a login makes it difficult to see who changed something. It can also give the agency access to other Google services associated with that account, possibly including email, advertising, documents, or business information.
It causes trouble when somebody leaves the agency too. The password then needs to be changed and updated everywhere it has been shared.
Individual access is safer and much easier to manage. Each person uses their own login, and their access can be removed without affecting anyone else.
What access should your agency have?
The appropriate level depends on what the agency has been asked to do.
An agency responsible for setting up Analytics, managing events or connecting other services may need Administrator or Editor access. Someone who exclusively prepares monthly reports may need less.
The client should still have at least one trusted Administrator within the business.
Avoid making a former employee’s personal Gmail address the only client-side administrator. Ideally, access should be connected to a company-controlled address that can be retained when staff change.
It is also worth having more than one appropriate administrator. That reduces the risk of losing access because one person leaves, forgets their login details or becomes unavailable.
What about Google Search Console and Tag Manager?
Google Analytics is only one part of the picture.
Google Search Console provides information about how your website appears in Google search results. It can show which searches bring people to the site, which pages are indexed and whether Google has found technical problems.
Google Tag Manager may be used to control Analytics and other tracking tools installed on the website.
These services ought to follow the same general principle:
- The business should retain access and control.
- Agencies should use their own individual logins.
- Passwords should not be shared.
- Access should be reviewed when a supplier or employee leaves.
- The account should not depend on one person’s private email address.
Google Business Profile and advertising accounts deserve similar attention. Losing access to any of these can cause a surprising amount of disruption.
What happens when you change web or marketing agency?
Changing agency should not mean restarting your website tracking.
Your new provider should normally be added as a user to the existing Analytics property. The previous agency can then be removed once the handover is complete.
There is usually no reason to create a brand-new property just because the supplier has changed. Doing so can leave you with reports split across two properties, making year-on-year comparisons harder.
Before ending the relationship with the old provider, check that your business has sufficient access to:
- Google Analytics
- Google Search Console
- Google Tag Manager
- Google Business Profile
- Google Ads, if used
- The website domain
- Website hosting
- The website itself
Do this while communication is still open. Recovering access several months later is usually much harder.
How to check who controls your Google Analytics
Log in to Google Analytics and open the Admin area.
Check both account-level and property-level access. Look for your company email address and confirm which role it has been given.
You should be able to answer these questions:
- Can someone within the business log in?
- Does the business have Administrator access?
- Is the website inside its own Analytics account?
- Which employees and external suppliers currently have access?
- Are any former employees or previous agencies still listed?
- Is the account connected to an email address the business controls?
- Can the business add and remove users without asking an outside agency?
If you cannot answer these questions, ask your current web or marketing provider to explain the setup.
A professional provider should be able to tell you where the property is located, who has access, and how the account would be handed over.
What if the agency currently controls everything?
There is no need to panic.
Start by asking the agency to add a company-controlled email address as an Administrator. You can then review whether the property should remain where it is or be moved into a dedicated Analytics account for your business.
When a Google Analytics property is moved to another account, its tracking ID and existing reports are retained. The person carrying out the move needs the correct access to both accounts, and any Google services connected to the property need to be checked first.
Creating a new property starts a new set of reports from that date. Everything collected before then stays in the old property, leaving you to switch between the two whenever you want to compare performance over a longer period.
A simple approach for new websites
When a new website is being built, agree on the account configuration upfront.
The preferred arrangement is simple:
- Create a dedicated Google Analytics account for the client’s business.
- Add a company-controlled client email as an Administrator.
- Add the web designer or agency through its own business login.
- Record which services have been connected.
- Review access when the project finishes or a supplier changes.
This takes very little extra time and prevents a much bigger job later.
Your website data should not be held hostage
Most access problems are not the result of anything sinister. Accounts are often created quickly during a website build and then forgotten. Years pass, staff change, and nobody checks whether the existing arrangement still makes sense.
Even so, website data is valuable. It shows how people find your business, which pages they visit and how the site has performed over time. You should not lose access to that history because you decide to work with somebody new.
Your agency can manage the technical side. Your business should still hold the keys.
If you are unsure who controls your Google Analytics, Search Console or website accounts, a website review can help identify what is in place and what needs attention. A quick review is free, with no obligation to proceed with a more detailed website or SEO audit.
