Which Local SEO assets should a business control?
The business should control the assets that would stop marketing or operations if a vendor disappeared, and then grant agencies the access type each tool actually supports.
There is no single permission model for every third-party platform. Some tools only have “admin.” Others have owner, manager, editor and viewer. Use the table as a governance map, not as a claim that every product works the same way.
| Asset | Should the business control it? | Typical agency access | Risk if lost |
|---|---|---|---|
| Domain | Yes — registrant and billing | DNS edit if they manage records, not the only registrar login | Site, email and Search Console DNS verification vanish |
| DNS | Yes | Named user or documented change process | Downtime, email failure, lost verification records |
| Hosting | Yes, or a contract that survives vendor change | Publish access | Website offline |
| Website CMS | Yes — company admin | Editor or administrator as needed | Cannot update pages or recover content |
| Google Business Profile | Yes — primary owner on a company account | Owner or manager as the work requires | Cannot edit Maps listing; recovery is slow |
| Search Console | Yes — at least one company verified owner | Full or restricted user; delegated owner if needed | No indexing diagnostics; vendor can remain verified via leftover tokens |
| GA4 | Yes — organisation administrator | Editor or analyst as needed | Lost history and conversion configuration |
| Google Tag Manager | Yes — organisation admin on the account | Publish or approve on the container | Tracking breaks; Search Console GTM verification may persist |
| Call tracking | Yes — billing and admin | User role if the vendor configures numbers | Published numbers die; GBP phone rules still apply |
| Rank tracking | Prefer a company seat | Shared project access | History stuck on an agency subscription |
| Citation accounts | Yes where the directory allows it | Editor access | Cannot update NAP after a move or rebrand |
| Social accounts | Yes — business manager or equivalent | Role-based access | Brand pages stranded |
| Yes | Usually none, unless they run mail | Forms and password resets fail |
Who should be primary owner of GBP?
A Google Account the business will still control if staff and vendors change should be primary owner.
Primary ownership is a continuity role. Managers can post, reply and edit many fields. They cannot transfer primary ownership. If an employee’s personal Gmail is primary owner, an agency handover or a resignation becomes an access emergency. That emergency is described in lost access to a Google Business Profile. Source: Transfer primary ownership of a Business Profile.
What does Search Console ownership mean?
Search Console ownership means full control of the property, including users and settings. Verified ownership is proved with a token on the site, DNS, Analytics or Tag Manager.
Delegated owners have the same in-product permissions until they are removed from the users list, but they did not place a token. A property needs at least one verified owner. When you remove a previous verified owner, remove all of their tokens so they cannot re-verify. Unused tokens can be reviewed in Users and permissions. Sources: Managing owners, users, and permissions and Improving Search Console ownership token management.
Who should administer GA4?
Someone inside the organisation should hold administrator rights on the GA4 property the business relies on.
Agencies often need edit access to create events and audiences. That is compatible with company administration. If the only administrator is the vendor, you cannot add the next practitioner or export a full backup of configuration.
Why should GTM remain under organisational control?
Google currently recommends that Tag Manager accounts be managed by someone in your organisation, not an external agency, and that you use individual accounts instead of shared logins.
If you use Google Marketing Platform, linking Tag Manager to the organisation improves visibility of who has access. Agency users can still have container-level publish rights. The organisation keeps the account. Source: Managing users and permissions.
Should agencies ever receive admin access?
Yes, when the work genuinely requires it — for example publishing containers, verifying Search Console, or administering a CMS the vendor must deploy to.
Withholding all admin rights can block legitimate implementation. The failure mode is exclusive admin: only the agency can add users, export data or recover the property. Grant admin and keep a parallel company admin.
Why are shared passwords a bad process?
Shared passwords hide who changed what, survive after people leave, and often violate the product’s user model.
Google Tag Manager explicitly recommends actual user accounts instead of shared logins. Business Profile, Search Console, GA4 and most CMSs support named users. Use those roles. Store recovery codes for company accounts in a business-controlled password manager, not in a Slack message.
What if the agency originally created everything?
Treat creation as a reason to transfer ownership now, not as a reason the vendor should keep being the only owner.
Ask them to add company accounts as primary GBP owner, verified Search Console owner, GA4 admin and GTM admin while they still have access. If they built the site on their proprietary platform, negotiate an export or migration before the next renewal. A future handover is described in how to change Local SEO agencies without losing access.
What should happen when an employee leaves?
Remove their access from every Local SEO account on the last day, and confirm no personal Gmail remains primary or verified owner.
Transfer primary GBP ownership before they go if their account holds it. Remove Search Console tokens. Rotate CMS and registrar credentials that were shared. The same checklist applies to contractors.
Digital asset ownership checklist
Vendor role
Agency: permission-based access Grant the roles needed to do the work. Continuity should not depend entirely on a vendor login.
- Company Google Account is GBP primary owner.
- Company account is Search Console verified owner; leftover tokens are removed when people leave.
- GA4 and GTM have organisation administrators; agencies have named users.
- Registrar, hosting and CMS billing are not on a personal card of a former staff member.
- No shared master password for Maps, Analytics or Tag Manager.
What not to assume
Do not assume the person who “handles SEO” owns the accounts. Do not assume a workspace email is verified in Search Console. Do not assume call-tracking numbers on Maps are the business’s numbers.
What not to do
Practical action plan
- Export user lists from GBP, Search Console, GA4, GTM, CMS and registrar.
- Create or identify company-controlled Google Accounts.
- Add those accounts as owners/admins while current admins still cooperate.
- Replace shared logins with named users.
- Document the map and review it when staff or vendors change.
When professional help makes sense
Help is useful when tokens, Tag Manager verification and hosting are tangled across several former vendors. An audit of access is not the same as recovering a listing you already lost.
Sources and further reading
- Google Business Profile Help: Transfer primary ownership of a Business Profile
- Search Console Help: Managing owners, users, and permissions
- Tag Manager Help: Managing users and permissions
Not sure who actually controls your Local SEO assets?
Otepsphere can help audit access across the core accounts required for Local SEO and identify continuity risks before they become an emergency.
Contact OtepsphereWho writes this
This page is published by Otepsphere, a specialist Local SEO consultancy. A named founder biography, photograph and professional profiles will be added here only when they have been verified. Until then, treat Otepsphere as the responsible organisation rather than a fictional expert.