Should you give your marketing agency your email password?
No. Start with the task the agency needs to perform, then arrange suitable access to the relevant service. Editing business hours does not require handing over a mailbox. Reviewing search performance does not automatically require permission to make changes.
A mailbox can contain private correspondence and recovery messages for other accounts. The consequences of sharing its password depend on the account's protections and connections, but they may reach well beyond the work you intended to authorize. You do not need to accuse a supplier of bad intentions to choose a more controlled arrangement.
Decide what the agency needs to do
Ask for a short explanation of the requested access: which service, which task, what the person will be able to change and when the access should end. Keep that explanation with the agreed scope so both sides can refer to it.
Distinguish looking from acting. An initial assessment may need selected information, while implementation requires permission for particular changes. Google's guidance on hiring an SEO specifically recommends read access to Search Console at the audit stage, rather than write access.
Do not respond to every difficulty by increasing permissions. If an agency cannot see a report, first establish which property or account is involved and what the task actually requires. A request for broader access should have an explanation, not just a statement that it would be quicker.
What access does an agency need to your Google profile?
Google's Business Profile role guidance provides separate access through each participant's Google Account. A Manager can edit significant profile information and respond to reviews; an Owner also controls users and profile removal. Manager is not a harmless viewing role.
Choose the role against the actual work. Someone asked to inspect public information may need no profile role for that part of the task. Someone authorized to maintain the listing may need editing access. Keep business control of ownership and agree which changes need approval before work begins.
A permission is a technical capability, not a complete instruction. Giving a person the ability to edit a phone number does not explain which number is approved or whether they should change it today. Record important factual decisions separately.
How to give someone access to your Google Business Profile
The documented route is More > Business Profile settings > People and access > Add. Enter the recipient's email, select the intended role and choose Invite. Check the recipient carefully before sending.
Agree which account the supplier will use and who is responsible for it. Avoid relying on an address copied from an unexpected message without confirming that it belongs to the intended person. Afterwards, check the access list rather than assuming that sending an invitation completed the arrangement.
Google lists pending invitations on the same page. New participants face a seven-day restriction on certain operations; waiting does not turn a Manager into an Owner. These are documented product rules, not a report of a check inside your particular account.
Keep Search Console and other services separate
Search Console has its own permissions model. A Full user can view data and take some actions; a Restricted user has limited viewing rights. Those labels do not correspond to the Business Profile roles.
Website administration, hosting, domain registration, advertising and email are separate access decisions. Build a simple list of the services actually involved, the responsible business contact and the reason for any supplier access. Do not assume that an invitation in one product covers everything else.
Also distinguish signing in to a tool from granting it access to business data. Google's guide to third-party connections separates sign-in, linked accounts and permissions to access data. Read the requested permissions. A Google sign-in screen alone does not prove that a tool obtained your email password or a Manager role.
If a service lacks the arrangement you expected, ask the provider or administrator about supported alternatives before sharing credentials. Do not assume that every product offers the same roles.
How to remove an agency's access when work ends
Plan the handover while communication is still working. Confirm the files, outstanding changes and business contacts needed to continue the work. Review access service by service, including invitations that were never accepted.
For Business Profile, an Owner uses People and access > Remove person. Earlier contributions remain. A primary owner must transfer primary ownership before leaving. Consult the linked guidance if your role or a recent invitation limits the available action.
Search Console needs particular care: removing a verified owner does not itself revoke their verification tokens. Remaining tokens can allow re-verification. Google's permissions guidance explains how to identify those tokens and warns that they may also support other services. Have the responsible administrator remove only the relevant access and check dependencies; do not delete arbitrary website tags or DNS records.
Finish by checking the resulting state. A removal request, a supplier's reassurance and a verified access list are different evidence. Record unresolved access explicitly instead of calling the handover complete because an email was sent.
What if you have already shared the password?
Do not send it to another person for checking. Replace the shared credential through the provider's legitimate account settings and review what else may have been granted. Sharing a password does not prove that the account was misused, but it warrants checking the arrangement.
If there are signs of unauthorized access, follow Google's compromised-account guidance. It covers recovery when you cannot sign in, security events, devices, recovery details and connected apps. For Gmail, review delegation, forwarding and filters as well. Google also explains password changes for affected connected services and additional sign-in protection.
Check separately for people or applications added while shared access was available. Changing a password does not answer whether a supplier still has its own authorized role. If you cannot explain a change or regain control, use the provider's official support route or appropriate security help. Do not promise yourself that a single action removed every possible route.
What if the agency will not transfer ownership?
Google's ownership guidelines for authorized representatives require them to respond to management-access requests promptly and transfer ownership to the business owner on request. The guidance also links to resolving ownership conflicts.
Keep the relevant account and business records so the request can be evaluated. Use the official process for the actual situation; do not create a duplicate listing or try to access somebody else's account. A policy requirement is not a guarantee that a disputed case will be resolved immediately.
For help examining the access needed for an assessment, see the profile audit. The Profile guide covers related questions about managing business information.
Frequently asked questions
should you give your marketing agency your email password
No. Agree the task and grant suitable access through the relevant service. A mailbox password can expose correspondence and account-recovery routes beyond the marketing work.
how to give someone access to my google business profile
An owner can invite the agency's Google Account through People and access. Confirm the account, choose the role for the agreed task and check whether the invitation has been accepted.
what access does an agency need to my google profile
It depends on the work. Manager permits significant everyday edits, but does not include managing users or removing the profile. Do not treat it as read-only access.
how to remove someone from my google business profile
An owner can select the user in People and access and choose Remove person. Check pending invitations too. Removing a person does not undo their earlier published work.
What to do if you have already given your password out
Replace the shared credential and review the account's security and separately granted access. Use your provider's recovery process if you cannot sign in. Do not assume one password change finishes the review.
Can an agency refuse to hand the profile back
Google's rules require authorized representatives to transfer Business Profile ownership to the business owner on request. A dispute may still need the official ownership or support process; immediate technical recovery is not guaranteed.