What access should an agency ask for? Meta and Google access levels explained

Ask for the level that lets you do the work, and leave every level that can change who has access with the client. On Meta that means partial access with the tasks you need, such as Ads and Insights on a Facebook Page, Manage campaigns on an ad account and Use events dataset on a dataset. On Google it means Standard in Google Ads, Editor or Marketer on one Analytics property, and Publish on one Tag Manager container.

That rule is our advice, not a platform rule: Meta and Google let a client give any level. Meta's help points the same way: it says giving people only the permissions they need helps keep business portfolios and assets more secure.

Every platform uses its own names. Below, each account is split into three working levels: one that only looks, one that does the work, and one that also controls who has access. The names are the platforms' own, as their help pages give them.

The three levels, and where the line is

• Looks. Reports and data, no changes. Right for someone who only reports.
• Does the work. Creates and edits ads, posts, tags or settings. Right for an agency that runs the account.
• Controls who has access. Adds and removes people, and on Google Ads also accepts manager links and links other products. This level stays with the client unless one job needs it.

On Meta, every asset has two levels. Full access is the top level; Meta's help now says "full access (formerly full control)", while several of its other help pages still say full control. Partial access is a set of tasks you pick one by one. The glossary lists the other names that changed.

The line is not always where you would expect it. In Google Ads the work level includes billing, and on a Meta dataset the level that creates audiences also edits user access. Those cases are named below.

Facebook Page

Meta's Page access for partners offers partial access or full control. The partial-access tasks for a partner are:

• Content: create, manage or delete posts, stories and more as the Page.
• Community activity: review and respond to comments, remove unwanted content and report activity.
• Messages: send and respond to messages as the Page. Meta's asset table calls this Messages and calls.
• Ads: create, manage and delete ads for the Page.
• Insights: see how the Page, its content and its ads perform.

Meta's asset table also lists Revenue and two creator tasks, which this guide leaves out.

• Looks: Insights.
• Does the work: Ads and Insights for ads. Add Content, Community activity and Messages if the agency runs the Page day to day.
• Controls who has access: full control. A partner with full control can give access to others and remove anyone from the Page. Meta still keeps the most sensitive actions from a partner, such as deleting the Page or moving it out of a business portfolio.

Meta says that to advertise for a Page you need full control or partial access with Ads. Steps: give an agency access to a Facebook Page.

Instagram account

The tasks are Content, Messages, Community activity, Ads and Insights, plus Creator management and Creator content for Meta's Creator Marketing Hub. Full access (Meta's table calls it Everything) adds giving and removing access, except for the person who created the account, and managing the payment method used to run ads.

• Looks: Insights.
• Does the work: Ads and Insights for ads, or Content, Community activity and Messages for running the account.
• Controls who has access: full access.

If the Instagram account is connected to a Facebook Page, Meta notes that anyone with access to either the Page or the Instagram account can manage both, so choose the tasks on both with that in mind. Steps: give an agency access to Instagram.

Meta ad account

In a business portfolio, Meta's ad account levels are:

• View performance: view ads and access reports.
• Manage campaigns: also create and edit ads.
• Manage ad accounts: full access. It adds control of the ad account's settings, finances and permissions.

There is also Manage Creative Hub mockups, which covers mockups only.

• Looks: View performance.
• Does the work: Manage campaigns.
• Controls who has access: Manage ad accounts.

An ad account used outside a business portfolio has roles in Ads Manager instead: Admin, Advertiser and Analyst. Meta describes Advertiser as the role for someone who builds and manages campaigns but should not control billing or who has access, and names an agency managing campaigns as an example. Steps: give an agency access to a Meta ad account.

Dataset (pixel)

A dataset has two levels in Meta's table, and no view-only level:

• Use events dataset: view the data and analytics, and create conversion ads with the dataset.
• Manage events dataset: full access. It adds control of all settings, adding or removing events, editing user access and creating audiences.

For running conversion ads, Use events dataset is the working level. The catch is audiences: in Meta's table, creating audiences comes only with Manage events dataset, and that level also edits user access. If the agency needs to build audiences from the dataset, either the client builds them, or the client gives full access knowingly and lowers it when the job is done. Steps: share a pixel or dataset.

Google Ads

There are two routes, and only one of them has a level to choose.

An invitation by email gives one person one of Google's access levels: Email-only, Billing, Read-only, Standard or Admin. Google's table shows:

• Read-only: view campaigns, use planning tools, view users and managers, and edit and run reports.
• Standard: all of that, plus edit campaigns and edit billing information.
• Admin: all of that, plus give account access and change access levels, accept and reject manager link requests, unlink manager accounts, add or remove product links, and link the account to Google Analytics to import conversions.

The working level is Standard. Note the billing line: in Google's table, no level that can edit campaigns is kept out of billing information, so if the client wants billing kept apart, agree on it rather than look for a level.

A manager link connects the client's account to the agency's manager account, which Google's help still labels MCC. It has no level of its own. What each person at the agency can do in the client's account follows their own level in the agency's manager account, and whether the manager account is an administrative owner of the client's account. Google says linking does not make it an owner. Even without ownership, a person with administrative access in the manager account can invite users to the client's account with Standard, Read only or Email only access, and move users between Standard and Read only. If the client makes the manager account an owner, its admins can also add and remove admin users, unlink other managers and transfer ownership.

Google describes manager accounts as suited to agencies that manage several client accounts. The part for the client to keep is ownership. Steps: the manager link and Google Ads access for the client.

Google Analytics 4

Analytics has five roles. Google says Analyst includes Viewer, Marketer and Editor each include Analyst, and Administrator includes Editor:

• Viewer (formerly Read & Analyze): see settings and data, and create explorations.
• Analyst (formerly Collaborate): also share explorations with other users of the property.
• Marketer: create, edit and delete audiences, events and key events, import key events into Google Ads, and edit attribution settings.
• Editor (formerly Edit): full control of settings at the property level, but cannot manage users.
• Administrator (replaces Manage Users): manage users and assign any role, including to themselves.

For an agency, that gives:

• Looks: Viewer, or Analyst if the agency shares explorations.
• Does the work: Editor for setup, or Marketer if the work is audiences, key events and the Google Ads import.
• Controls who has access: Administrator.

Give the role on the property, not the account. Google says a role given at the account level applies to every property in that account. Steps: give an agency access to GA4.

Google Tag Manager

Tag Manager has two layers. The account permission is User, which lets a person view basic account information, or Administrator, which adds creating containers and changing user permissions. The container permission is set per container:

• Read: browse tags, triggers and variables, with no changes.
• Edit: create workspaces and make edits, but not create versions or publish.
• Approve: also create versions, but not publish.
• Publish: full rights, including publishing.

For an agency, that gives:

• Looks: User with Read.
• Does the work: User with Publish on the one container the agency works on. Publish means the agency can change what runs on the client's website. If the client wants to review changes first, Edit or Approve leaves publishing with the client.
• Controls who has access: Administrator on the account.

Google also advises that the Tag Manager account is managed by someone in the client's own organization, not an external agency. Steps: give an agency access to Tag Manager.

Search Console and Merchant Center

Search Console has three permissions: Owner, Full user and Restricted user. Only owners can add users, and owners can add and remove other owners. A Full user sees all data and can take some actions, such as submitting sitemaps. A Restricted user has simple view rights on most data. The working level for an agency is Full user, and ownership stays with the client. Steps: add a user in Search Console.

Merchant Center lists Admin, Standard, Read-only, Email-only and Performance and insights, plus a few special roles. Only admins can add, remove or edit people. Standard can work on products, feeds and account settings, but cannot manage others, work with reports, view performance insights, enable programs or link Google Ads accounts. Performance and insights is Google's level for custom reports and dashboards. The working level is Standard, with the client's admin doing the Google Ads link. An agency that uses Merchant Center for Agencies, which Google says is available on a limited basis, requests either Admin or Standard + performance and insights when it asks to link a client's account. Steps: give an agency access to Merchant Center.

When full control is justified

Some jobs only the top level can do. In the help pages above:

• Google Ads: linking Google Analytics to import conversions, adding or removing product links, and accepting or unlinking manager links.
• Merchant Center: starting the link to a Google Ads account, which Google says only a Merchant Center admin can do, and an admin on the Google Ads account approves.
• Meta dataset: creating audiences from the dataset and changing its settings and events.
• Meta catalog: connecting the catalog to other business assets, which also needs full access to the other asset.

For a one-off job like these, there are two clean options. The client does that one step, or the client raises the level for the job and lowers it afterwards. Meta says permissions can be changed at any time, and in Google's products an admin can change a person's level.

Full control on Meta is still not ownership. Meta says a partner with full control cannot share the asset with another business, and a Page partner with full control cannot delete the Page or move it out of the client's business portfolio. The client remains the owner either way.

Doing it with an access link

Our access link asks for one level per account. The agency switches on what it needs from the client and sets the access level for each, and the client sees who is asking and for what before confirming. A Google Ads manager link carries no level of its own there either.