Checklist

Ad account access and security: who should own what

Your business should always own its ad accounts, payment methods and pixels, and give freelancers or agencies access to them, never the other way round. Use partner or user access instead of sharing passwords, turn on two-factor authentication, give the lowest access level that does the job, and remove people when the work ends.

By the Moonlighters team. Last updated 13 October 2026.

Principles

You own it. The ad account, the business page, the pixel or conversion tag and the payment method should belong to your business, with you as an admin.
Give access, not passwords. Platforms let you add people or other businesses with controlled permissions. Never share a login.
Least access. Give each person the lowest level that lets them do their job.
Two-factor authentication. Turn it on for every account that can spend money.
Remove access when it ends. When a freelancer, agency or staff member leaves, take their access away the same day.

Meta (Facebook and Instagram)

Create or use a business account in Meta's business tools, and keep at least two trusted admins so you cannot be locked out.
Add agencies and freelancers as partners, or as people with specific permissions, rather than asking for your personal login.
Keep the ad account and payment method under the business. Check who has permission to change billing.
Review the list of people and partners regularly.

Google Ads

Create the account under a Google account your business controls, with a second admin.
Use the access levels: read only, standard and admin. Most helpers need standard, not admin.
If an agency uses a manager account, make sure you can still see everything in your own account and can remove the link.

Menu names and permission labels change, so check each platform's current help pages.

Questions to ask any provider

Will my accounts be in my name, with me as admin?
Will you work through partner or user access, not shared passwords?
What access level do you need, and why?
What happens to access and data if we stop working together?

Keep a simple record

A list of every account, who owns it and who has access.
Account IDs and the email address each is tied to.
When access was last reviewed.

Why it matters

If an agency owns your ad account, your history, audiences and learning sit with them. If a single person holds the only admin login and leaves, you can lose the account. Both are avoidable with an hour of setup. See also the comparison of freelancers, agencies and subscriptions for questions to ask before you sign.