Chapter 7: Ownership, Access and Control

7.1 Ownership and Access Control

A Google Business Profile can be managed by more than one person.

That is useful because the business owner is rarely the only person who needs access. There may be employees, marketing staff, an agency, an external consultant or several people responsible for different parts of the profile.

Google currently describes two access roles for an individual Business Profile: owner and manager. A profile can have multiple owners, but only one of those owners is the primary owner.[1]

Each person can use their own Google Account, so there is no need to share one username and password.[1]

The most important principle is the one we established in Chapter 6:

The business should retain control of its own Business Profile.

An agency may manage almost everything. It may do the day-to-day work. But the profile still represents the client's business.

Owners have full control of the profile, including the ability to add and remove users. Managers can perform most everyday management work, including editing information, responding to reviews and managing posts, but they cannot add or remove users or remove the profile.[1]

If manager access is enough to perform the work the agency has been hired to do, manager access may be enough.

Owner access may be appropriate where the agency genuinely needs to administer users or carry out actions unavailable to managers. But primary ownership should normally remain with an account controlled by the business.

The easiest way to understand why is to imagine the relationship ending.

A client hires an agency to manage its Business Profile for three years. Then it decides to bring the work in-house.

Nothing dramatic has happened. Nobody has fallen out. The client simply no longer needs the agency.

If the access structure was set up properly, the change is straightforward. Remove the agency's access and the client still controls the profile. The reviews remain. The photographs remain. The posts remain. The business carries on.

That is how it should work.

Now imagine the agency created the profile using an account only the agency controls and made itself the primary owner. The client leaves and discovers nobody inside the business has proper control.

What should have been a simple change of supplier has become an ownership problem.

The cleaner approach is to keep control with the business from the start.

The same principle applies to employees.

Give the appropriate people access through their own Google Accounts.

If somebody leaves the business, remove their access.

If responsibilities change, change their access.

If a previous agency no longer manages the business, remove it once the correct ownership structure is safely in place.

Google's own security guidance makes the same point from another direction: keep access limited to the owners and managers who are actually needed, remove former employees and make sure the business retains access when a third party manages the profile.[3]

The purpose of access control is to make sure the right people can do the right work without the business losing control.

7.2 Keep the Structure Simple

For most businesses, access control should be boring.

That is a good thing.

A sensible agency-managed setup will usually have one business-controlled account holding primary ownership, with additional owner access only where there is a genuine reason for it. The agency and other people handling day-to-day management can then be given the level of access they actually need.

The exact structure will vary.

What matters is that every person with access has a current reason to be there.

No shared passwords.

No former employees who left years ago.

No previous agencies that no longer need access.

No mystery account holding primary ownership that nobody at the business can reach.

The fewer unnecessary users there are, the easier the profile is to understand and control.

This becomes especially important when agencies change.

Before removing an old agency, make sure the client already has the correct ownership structure. Begin by making sure the right people are safely in.

Then tidy up the rest.

Google applies a seven-day restriction to newly added owners and managers. During that period, they cannot perform certain actions, including removing other owners or managers, deleting or undeleting the profile, or transferring primary ownership.[1][2]

So if a new client comes to you with a badly structured profile, the sequence matters.

Get the right people added first. Allow the seven-day restriction to pass where necessary. Transfer primary ownership if it needs correcting. Then remove access that is no longer required.

The process is straightforward when it is done in the right order.

7.3 Agencies Should Manage Access, Not Passwords

An agency can manage a client's Business Profile without asking for the password to the Google Account that controls it.

Google provides owner and manager access specifically so different people can work on the same profile without sharing credentials.[1]

The client keeps control of its own account.

The agency uses its own account.

Individual members of staff use their own accounts.

If somebody leaves, their access can be removed without changing everybody else's login.

That creates a cleaner handover and makes it much easier to understand who can currently change the profile.

For agencies or organisations managing larger sets of profiles, Google also provides business groups as a way to share access across a collection of Business Profiles without passing around a common login.[4]

The principle is the same whether we are dealing with one profile or fifty.

Access should be attached to the people and organisations that need it.

7.4 Access Changes as the Business Changes

Access control changes with the business.

People leave.

Agencies change.

Roles change.

Responsibilities change.

So the access structure should change with them.

Review access when people, responsibilities or suppliers change, and check it periodically so forgotten access does not accumulate.

The questions are straightforward.

Who is the primary owner?

Does the business control that account?

Who else has owner access, and do they still need that level of control?

Who has manager access?

Do they still work with the business?

Is a former employee still listed?

Is an old agency still there?

Does anybody have access for no current reason?

If the answer to those last questions is yes, tidy it up.

Good Google Business Profile management includes knowing who can change the profile as well as what appears publicly.

That is the job of access control.

Keep primary ownership with the business.

Give other people the access they genuinely need.

Remove access when it is no longer required.

Use individual Google Accounts rather than shared passwords.

And make sure a client can leave an agency relationship while retaining control of its own Business Profile.

That is all this chapter needs to do.

Notes

1. Google Business Profile Help, “Manage your Business Profile owners and managers”, https://support.google.com/business/answer/3403100?hl=en-GB. Checked 3 September 2026.
2. Google Business Profile Help, “Transfer primary ownership of a Business Profile”, https://support.google.com/business/answer/3415281?hl=en-GB. Checked 3 September 2026.
3. Google Business Profile Help, “Help protect your Google Business Profile”, https://support.google.com/business/answer/14509283?hl=en. Checked 3 September 2026.
4. Google Business Profile Help, “Create and manage business groups”, https://support.google.com/business/answer/6085339?hl=en-GB. Checked 3 September 2026.