Why ad account ownership matters
Before fixing anything, separate two ideas the platforms themselves keep distinct: **ownership** and **access**.
- **Ownership** is the entity the account belongs to. Meta's Ad Account object carries an explicit `owner` field, and its Business Management API distinguishes whether your business acts as an `OWNER` or an `AGENCY` of each ad account. On Google, control shows up at two layers: who holds Admin on the account, and whether a linked manager account (MCC) has ownership — which determines who can edit users, managers, and product links. - **Access** is what the owner grants: Meta's task roles (`ANALYZE`; `ADVERTISE` + `ANALYZE`; `MANAGE` + `ADVERTISE` + `ANALYZE`), Google's access levels (Email-only, Billing, Read-only, Standard, Admin), and TikTok Business Center member roles.
Ownership decides three things operators and finance leaders care about:
1. **Billing control.** Who can change payment methods, credit lines, and invoicing — and who keeps getting charged if a dormant account is misused or compromised. 2. **Portability.** Campaign history, audiences, conversion tracking, and pixels live inside the account. Practitioners consistently warn that if a third party owns the account, you may be unable to take that data with you when the relationship ends. 3. **Recovery leverage.** Security researchers describe a mature market for stolen Meta and Google ad accounts in which aged, trusted accounts sell at a premium — and attackers who get in often add their own admins and downgrade the legitimate owner, making recovery slow and uncertain.
An ownership and access audit answers one question: if your agency disappeared tomorrow, or your main admin's profile was suspended tonight, could you still control billing, remove every stale user, and keep your data? The sections below walk platform by platform.
How to audit Meta ownership and access
Meta ownership sits at the **Business Portfolio** level (formerly Business Manager), not the personal profile level. Also note that restrictions can hit four different layers — a person's profile, an ad account, a Page, or the whole portfolio — so record which layer is affected instead of treating 'restricted' as one state.
**Audit steps:**
1. **Confirm the owning portfolio.** In Business Settings, open Accounts → Ad Accounts and confirm which business owns each account. Via API, `GET /<BUSINESS_ID>/owned_ad_accounts` lists owned accounts, and the `access_type` field shows whether your business acts as `OWNER` or `AGENCY`. 2. **Review every assigned person and their tasks.** Meta's task model maps directly to power: `ANALYZE` is reporting-only; `ADVERTISE` + `ANALYZE` can create and edit ads using the account's funding source; `MANAGE` + `ADVERTISE` + `ANALYZE` can manage campaigns, reporting, billing, and ad account permissions. Flag anyone holding `MANAGE` who should not control billing. 3. **Review Partners.** Agencies and freelancers should appear as partners with scoped asset access — not as the owning portfolio. 4. **Check claim status and permanence.** Pending ownership requests surface via `pending_owned_ad_accounts`. Two hard rules from Meta's documentation: claiming is a one-time procedure after which the account can only be managed in that Business Manager, and you cannot remove accounts from your business once you are the `OWNER` and the claim is `CONFIRMED`. 5. **Edit permissions at the right level.** Meta's official guidance: once an ad account is in a business portfolio, you manage its permissions from Settings in Meta Business Suite — you can no longer edit them from ad account settings in Ads Manager. 6. **Mind the documented caps.** Meta lists a maximum of 25 people with access per ad account and 25 ad accounts per person.
**On transfers:** Meta does not publish a guaranteed timeline or outcome for moving ownership between portfolios, and any change generally depends on the current owning business cooperating. Treat third-party claims about fixed transfer windows as unverified, and plan transitions early.
How to audit Google Ads ownership
Google Ads control is layered: individual users hold access levels on the account, and manager accounts (MCCs) can be linked — with or without **ownership** of the child account.
**Audit steps:**
1. **Open Admin → Access and security.** The Users tab lists everyone with their access level; Google notes that admins can also review each user's authentication method and last login time. 2. **Map access levels to actual need.** Google's levels are Email-only, Billing, Read-only, Standard, and Admin. Only Admin can grant account access, change access levels, cancel invitations, accept or reject manager link requests, and unlink manager accounts. Standard can edit campaigns but cannot manage users. Apply least privilege. 3. **Inspect manager links and ownership.** Check which MCCs are linked and whether any has ownership enabled. Google is explicit: if the manager account has ownership, its admins can also edit user access, managers, and product links within your account. Google's security best practices recommend the Related managers tab to spot links outside your own MCC hierarchy. If your MCC lacks ownership, make user changes by logging in to the child account directly. 4. **Fix single-admin dependency.** Google warns that if your account has only one administrator, you may lose access to your tags if that user becomes unavailable, and recommends adding at least one additional administrator. 5. **Clean up stale access.** Remove users who have left and revoke pending invitations you no longer want. Google notes that until inactive users are removed, they can still sign in and make changes. 6. **Plan structure for scale.** A single Google Account can have direct access to up to 20 Google Ads accounts; beyond that, Google points to manager accounts. Also note that Google Ads users cannot directly edit payments-profile users — changes go through the payments profile's primary contact via Google Ads support.
How to audit TikTok Ads ownership
TikTok mirrors Meta's model: ad accounts should live inside a **Business Center** your company controls, with members assigned only the assets they need.
**Audit steps:**
1. **Check whether each ad account sits inside a Business Center.** TikTok shows a prompt on the Ads Manager dashboard when an account is not part of one. You can also navigate via Tools → Account setup, where the Permission management section contains the 'Link to Business Center' entry point. 2. **Verify you can link as an admin.** TikTok requires admin access to the ad account before linking. If you are an admin of the target Business Center, the linkage request is automatically approved; otherwise a request goes to that Business Center's admins — so confirm linkage requests land with your company, not a third party. 3. **Note availability limits.** TikTok states that linking a standalone account to an *existing* Business Center is only available to standalone ad accounts with an account manager, while linking to a *new* Business Center is offered more broadly. Where TikTok's documentation is silent on timing, do not assume instant approval. 4. **Review members and asset assignments.** Confirm who holds admin-level versus operator-level access on each ad account; TikTok requires operator or admin access to an ad account to link TikTok identities as delivery assets. 5. **Prefer organization-owned identities.** For brand TikTok accounts used in Spark Ads, TikTok supports creating organization-owned accounts that are owned by the Business Center itself rather than an individual, and recommends this approach for official brand accounts. Availability can depend on business verification, so check whether your Business Center is verified. 6. **Record billing ownership.** Document who controls payment methods and invoicing on each account so finance can act immediately if an operator leaves or an account is compromised.
Ready to upgrade your ad account infrastructure?
AdsInfra provides certified agency accounts for Meta, TikTok, and Google. Setup in 2-5 business days.
Talk to a SpecialistCommon access and ownership risks
These failure modes appear repeatedly in practitioner audits and platform guidance:
- **Agency-held ownership (lock-in).** If the account was created inside an agency's Business Manager, MCC, or Business Center and you were never made owner, your historical data, audiences, and tracking may not be portable when you leave. Practitioners describe the incentive bluntly: ownership creates lock-in. - **Personal or fake-profile ownership.** Accounts tied to an employee's personal profile leave when that person does. Worse, practitioners report that dummy profiles created to 'hold' assets violate Meta's real-identity expectations — if such a profile is banned, attached assets can be frozen with no real identity to verify. - **Shared logins.** One password across a team makes change attribution impossible, triggers security challenges and 2FA bottlenecks, and turns offboarding into a password-reset scramble. Google explicitly advises granting each person their own access instead of sharing credentials. - **Single-admin dependency.** Google's warning about losing tag access with only one administrator generalizes: one person holding the only admin keys on any platform is a continuity risk. - **Stale and excess access.** Departed employees, old freelancers, and lapsed agency partners retaining admin or billing rights, plus pending invitations nobody revoked. - **Dormant-account billing exposure.** An old account with a card still attached can keep accruing spend if compromised; practitioners note the only remedy may be cancelling the card entirely. - **Credential theft and takeover.** Security reporting describes stolen Meta and Google ad accounts sold with tiered pricing, and notes that attackers add their own admins and downgrade the real owner. Reclaiming ownership can take months, with no chargeback-style protection for fraudulent spend. - **Layer confusion.** On Meta, a restricted person, a restricted ad account, a restricted Page, and a restricted Business Portfolio are different states with different remediation paths — Meta's API even exposes distinct ad-account disable-reason codes. Record exactly which layer is affected before acting.
How to secure and consolidate ownership
Consolidation means every ad account sits inside a container your company owns, and every external party holds revocable access — nothing more.
1. **Own the container.** Your Business Portfolio, your manager account hierarchy, your TikTok Business Center. Create accounts under company credentials; invite agencies as partners (Meta), linked managers without ownership unless genuinely needed (Google), or Business Center partners (TikTok). Practitioner consensus is that agencies should manage campaigns without owning the accounts. 2. **Apply least privilege.** Google advises granting the minimum access each user needs. On Meta, reserve the `MANAGE` task set; on TikTok, assign only the assets each member requires. Keep admin counts small — but never below two. 3. **Harden authentication.** Require two-step verification for all users. Google additionally offers passkeys for sensitive actions, multi-party approval so a second administrator must verify sensitive changes, and a Security Agent that flags unusual access behavior. 4. **Offboard completely.** When an employee, freelancer, or agency leaves: remove their platform roles (Meta assigned users, Google Access and security, TikTok Business Center members), revoke pending invitations, remove partner or manager links that are no longer needed, confirm billing still belongs to your company, and close any shared workspace or browser-profile access that bypasses platform roles. 5. **Set a review cadence.** Run quarterly access reviews plus event-triggered reviews after staff exits, agency changes, payment failures, or any restriction notice. For each account, record the owner, admins, billing controller, and next review date. 6. **Know the recovery paths — and their limits.** Google documents a compromise workflow (report, re-authenticate, review a change log, clean up) and possible reimbursement for unauthorized charges, noting billing investigations can take 10–15 working days. Meta ownership changes depend on the owning Business Manager, and Meta publishes no guaranteed timeline or outcome — document everything before you escalate. 7. **Keep evidence.** Store dated screenshots of ownership, admin lists, and billing settings outside the platforms, so the next audit — or a dispute — starts from proof rather than memory.