The business should retain durable top-level control of its Search Console and Google Analytics access, then grant an SEO provider only the permissions required to do the work. An agency can be an administrator or delegated owner when necessary, but the client should not depend on the agency's account as the only path back into its own data.
- Search Console verified owners have the highest level of control and can manage other users; client organizations should preserve their own verified ownership path.
- GA4 administrators can manage users and permissions, so the business should keep at least one durable administrator under its own control.
- Offboarding should include removing agency users and stale Search Console ownership tokens, not merely changing a shared password.
01
Definition
“Who owns the SEO accounts?” sounds like a billing question, but operationally it is an access-control question. Google Search Console and Google Analytics do not use identical role models, yet both allow high-privilege users to manage who else can see or change important data.
Search Console distinguishes verified owners, delegated owners, full users, and restricted users. A verified owner proves control through a verification token and has the highest level of access; owners can add or remove users and configure property settings. [1]
Google Analytics 4 uses roles such as Administrator, Editor, Marketer, Analyst, and Viewer at the account or property level. Administrators can manage users and permissions. [2]
For a business hiring an SEO provider, “ownership” should therefore mean that the business keeps a durable administrative path that does not disappear when the vendor relationship ends.
02
Mechanism
The safest arrangement separates asset control from vendor access. The company maintains at least one owner-controlled identity with the highest appropriate privileges, then grants the agency or consultant the role required to perform the engagement.
In Search Console, a provider may need full-user or owner capabilities depending on the work. But making the provider the only verified owner creates avoidable dependency. Search Console's verification model ties verified ownership to tokens on the site or domain, and Google warns that old verification tokens can allow former owners to regain access if they are not removed. [3]
In GA4, an agency doing configuration work may legitimately need Editor or Administrator access. That still does not require the client's organization to surrender its own administrator role. Because administrators can add and delete users, a client-controlled administrator is the recovery path if a vendor account is disabled, an employee leaves, or a contract ends badly. [2]
The same principle generalizes beyond these two products to domains, DNS, tag managers, ad accounts, CMS administration, and hosting: the client should be able to remove the vendor without losing the asset. Vendor credentials are access; they should not be the sole root of control.
03
Examples
A small business hires an agency that creates a brand-new GA4 property inside the agency's own Analytics account and gives the client Viewer access. Reporting works for a year, so nobody notices the structural problem. When the contract ends, the client discovers that it cannot manage users or reliably continue the property without agency cooperation. The reporting service was delivered, but the access architecture was poor.
A cleaner setup creates or retains the Analytics account under client control, keeps at least one client Administrator, and adds the agency at the level it actually needs. The provider can still do the work. The difference is that offboarding becomes an access change rather than an asset-recovery negotiation.
Search Console creates a similar failure mode. An agency verifies ownership using an HTML file or DNS token, then remains a verified owner after the relationship ends. Removing the visible user entry may not be enough if a reusable verification token remains. Google's ownership-token guidance specifically tells site owners to audit and remove unused tokens when previous owners are removed. [3]
Another bad pattern is a shared generic login whose password is passed between the client and provider. Shared credentials blur attribution, complicate multifactor authentication, and make offboarding unnecessarily disruptive. Native user roles are cleaner: each person or organization receives its own access, and permissions can be revoked without rotating a company-wide password.
A larger organization may use group-managed or organizational identities rather than a single employee's personal account. The underlying requirement remains the same: the durable administrator should belong to the business, not to one transient person or outside vendor.
04
Boundaries
Client control does not mean agencies should be starved of permissions. If a technical engagement requires an action available only to owners or administrators, granting that role can be appropriate. Least privilege means “enough access to perform the task,” not “make the vendor beg for screenshots while pretending that is secure.”
Likewise, an agency having an owner or administrator role is not inherently suspicious. The risk appears when the business has no independent path to the same asset, cannot inspect current users, or has no offboarding procedure.
Google's documentation does not dictate who must contractually own a client's marketing accounts. The recommendation here is operational risk management derived from documented permission behavior. If the business controls the website and depends on the data, preserving an independent recovery and administration path is the sensible default.
Before signing an SEO agreement, inventory the critical systems: domain registrar, DNS, hosting, CMS, Search Console, GA4, Tag Manager, business listings, ad platforms, and any reporting warehouse. Record which client identity has top-level control and which vendor identities need delegated access. This takes less time than reconstructing ownership during a dispute.
At offboarding, remove vendor users, review Search Console ownership tokens, rotate shared secrets that truly had to be shared, transfer documentation, and verify that client administrators can still log in. [1] A professional provider should expect this process. If an agency treats basic account independence as disloyalty, that is procurement information worth having before the contract starts.
References
Sources behind this record
- Managing owners, users, and permissions — Google Search Console Help (accessed August 18, 2026)
- Access and data-restriction management — Google Analytics Help (accessed August 18, 2026)
- Improving Search Console ownership token management — Google Search Central (accessed August 18, 2026)
Corrections
Correction history
No corrections recorded.
To report an error, use the public corrections path.
Google documents roles and permission mechanics, not a universal commercial contracting rule; the client-ownership recommendation is a risk-management conclusion from those mechanics.