When cooperation with an agency or freelancer ends, it turns out that the key tools of the business — the Google Business Profile, analytics data, and domain access — are registered to the person who managed the marketing. Changing passwords does not help because access is tied to the contractor's Google account, not to the business. The owner loses visibility in maps, data history, and control over their own website — and often finds out too late, when the site stops working or the profile disappears from search results.
On this page you will find a method for auditing the four main digital assets of a business, understand what roles and permissions each platform provides, and learn specific steps to regain control without losing data. The instructions work regardless of whether you use agency services or handle marketing yourself.
Why run an access audit before a conflict, not after
Four digital assets of a business determine whether customers can find you and whether you can measure marketing results. The first is the Google Business Profile — the listing in Google Maps that appears with local search results. The second is Search Console — a tool that shows how Google sees your site and which queries bring traffic. The third is Google Analytics, especially GA4, where you collect data about user behavior. Fourth is the domain — your website address, without which the site ceases to exist.
When each of these is connected to a third-party account, you lose the ability to manage, monitor, and respond to changes independently. The agency can leave and take access to data history with them. The freelancer can lose access to their Google account and with it — access to your business profile. The domain registered to a contractor theoretically belongs to you, but without the authinfo code you cannot transfer it to another registrar. These four assets are the foundation of online visibility — and should be on your account, not someone else's.
Google Business Profile: many owners, but only one primary
A Business Profile can have many owners, but only one person is the primary owner. The difference is critical: the primary owner has full control over the profile — can add and remove users, edit all information, manage posts, and delete the profile if needed. Managers, previously called location managers, have almost the same access but cannot add or remove other users and cannot delete the profile. You cannot transfer primary owner permissions unless the profile has at least one additional owner or manager — this is a safeguard against accidental loss of control.
Each user should have their own Google account. Sharing one account among multiple people means all actions are tied to one email address, and losing the password blocks access for the entire team. Instead, add each team member as a separate user with the appropriate role — owner for decision-makers, manager for those managing day-to-day operations. After changing contractors, add yourself as an owner, then lower the previous owner's role to manager or remove them entirely.
Learn more about roles in Google Business Profile Help.
Search Console: at least one verified owner is required
Search Console requires that each property have at least one verified owner. The owner has full control over the property — adds and removes users, configures settings, views all data, and uses all tools. There are two types of owners: a verified owner confirms property ownership using a token (e.g., an HTML file uploaded to the server), and a delegated owner receives permissions from a verified owner without ownership verification. Both types have the same permissions.
In addition to owners, there are users with full or restricted permissions. A user with full permissions can perform most actions but cannot add or remove owners or delete the property. A user with restricted permissions has access only to some data and tools. Before changing agencies, check who is the owner of the property in Search Console and whether you or someone on your team has a role that allows adding users. If not — you simply will not have access to data about your site's visibility.
More details in the Search Console documentation.
Google Analytics 4: the Administrator role adds and modifies users
In Google Analytics 4, only a person with the Administrator role at the account or property level can add and modify users. This role is required both for adding new users and for removing existing ones — and this can only be done at the account level, not property. If you as the last administrator remove yourself, the system will not allow it — this is a safeguard against accidentally closing access to the entire account.
In practice, if your agency created a GA4 account on their Google account and did not give you the Administrator role, you cannot independently add or remove users, manage access, or even delete that account. Even if you have access to data views, you do not have control over who else has access. Before the agency leaves, make sure you have the Administrator role at the account level — otherwise, after changing contractors, you may lose access to months of data history.
Details in Google Analytics Help.
Domain .pl: subscriber rights and authinfo code
The subscriber of a .pl domain has rights specified in the .pl Domain Name Regulations. A registrar cannot, without the subscriber's knowledge and consent, transfer domain handling to another registrar, change subscriber data, update information, or delete the domain. This means you are theoretically safe — but only if the registrar knows that you are the subscriber. The problem arises when the domain was registered to the agency's data, not your business: the agency is then the formal subscriber, not you.
Upon your request, the registrar is obligated to immediately issue an authinfo code. The registrar cannot make issuing the code conditional on additional requirements, including fees — it can only collect its fees in other ways. The authinfo code is the key that allows transferring the domain to another registrar. If your current registrar refuses to issue the code despite you meeting the conditions, you can file a complaint with NASK under the .pl domain subscriber rights. In exceptional situations, NASK can issue the code directly.
Remember that each registrar may have a different procedure for issuing authinfo codes — before choosing a registrar, it is worth familiarizing yourself with its procedure, as differences can be significant when transferring domains in the future.
Audit table: four assets to check
The following table will help you quickly audit each of the four main assets. For each resource, check who is the primary owner, what is your role, and what do you need to do before changing contractors.
| Asset | Who is the primary owner? | What is your role? | What do you need to do? |
|---|---|---|---|
| Google Business Profile | Primary owner (1 person) or owner (multiple) | Owner / manager / no access | Add yourself as owner, lower agency's role |
| Search Console | Verified owner (min. 1) | Owner / full user / restricted / no access | Check verification, add your account as owner |
| Google Analytics 4 | Account Administrator | Administrator / editor / analyst / no access | Request Administrator role at account level |
| Domain .pl | Subscriber (WHOIS data) | None / registrar account owner | Request authinfo code, update subscriber data |
These four questions are enough to understand who really controls your business's digital assets within an hour.
How to regain control without losing data: five steps
The process of regaining control over digital assets consists of five organized steps. Perform them in this order so you do not lose access to data during the transition.
Step 1: add yourself to each of the four accounts
Add yourself as an owner or user with full permissions to each of the four assets. In Business Profile, send an invitation from your own Google account. In Search Console, add your account as an owner — preferably verify ownership using your own method (e.g., HTML file or tag in the head section). In GA4, ask the current administrator to grant you Administrator role at the account level. For the domain — request the authinfo code from the current registrar.
Step 2: wait 7 days
In Google Business Profile, a new owner or manager must wait 7 days before managing some functions, including removing other owners and managers. This is a platform safeguard — do not try to bypass it.
Step 3: verify your access
Log into your account and check whether you see all data, can add and remove users, and have permissions for key actions. If something is missing — report it before lowering the previous owner's permissions.
Step 4: lower the contractor's role or remove their account
Instead of deleting the resource (which results in loss of all data), reduce the former agency's permissions to a user with restricted access or completely remove their account from access. In Business Profile, lower to manager role if you want to keep continuity of responding to reviews. In GA4 and Search Console — remove completely if you do not plan further cooperation.
Step 5: update domain data
After obtaining the authinfo code and transferring the domain to your own registrar, update the subscriber data to your company data. This formally confirms your ownership and makes future transfers easier.
What not to do
Do not delete the resource hoping to recreate it from scratch — data history will be lost forever. Do not ask for passwords to someone else's account — this violates security rules and will not give you true ownership. Do not try to bypass verification — without it you will not have full access.
Do it yourself: asset list and review schedule
Do not wait for a conflict with a contractor — it is worth conducting access audits regularly, preferably quarterly. Prepare a list of all business digital assets and assign an owner and the date of the last review to each. The list should cover not only the four main resources (Business Profile, Search Console, GA4, domain) but also related accounts: business email (if you use Gmail or Workspace), hosting access, CMS panels, integrations with external systems.
For each asset, record: who is the primary owner, which Google or email accounts have access, what role each user has, and when these accesses were last checked. Set a calendar reminder — every three months review the list and ask: should each user still have access? Has anyone left the team and not been removed? Does the role match current responsibilities?
Additionally, it is worth maintaining a simple change log: date, who, what changed. Even if you use one contractor's services, knowing who has access to what allows you to react quickly in a crisis.
Asset registry, roles and reminders: how it looks in a system
When access to digital assets is managed systematically, the process becomes repeatable and safe. Instead of looking for passwords in notebooks or asking former employees about access, you have one place where you record: asset list (profile, Search Console, Analytics, domain, hosting, CMS), roles assigned to each person (who is owner, who has data access, who can manage users), next review date (e.g., quarterly), and change history (who, when, and what changes were made).
This approach eliminates the risk of surprise — you know in advance who has access to what and can change it before a conflict or contractor departure occurs. The system does not promise to recover every access on demand, but gives you tools to control who and when can make changes.
If you want to implement such a system in your business, see how a dedicated admin panel tailored to your process works: Admin panels — where you run your business: leads, clients, content and statistics in one place, with team roles.
Also check how your visibility in Google and maps translates into results: SEO and maps — visibility where the customer looks, within a few streets. If you need help getting found by local customers, Google Business Profile brings your listing to a complete state. To measure the effect, Analytics and BI shows where customers really come from. Need a new website? Websites and stores build a site around one customer decision. And Integrations connect the systems you already use into one data flow.
Read more about choosing an operating model: Automation on Your Own, with a Freelancer or an Agency: How to Choose a Model. See also Custom Automation or Ready-Made SaaS — when it's not worth implementing anything, Automation and GDPR — where your customer data physically ends up, and Errors When Implementing Automation — five situations where we advise against starting.
Frequently asked questions
Can I remove an owner from the Business Profile if I am only a manager?
No. Managers cannot add or remove users or delete the profile. You must first obtain the owner role or ask the current owner to add you as an owner. Only an owner can change the roles of other users.
What to do if the agency does not return the authinfo code for the domain?
According to the .pl Domain Name Regulations, the registrar is obligated to issue the authinfo code upon subscriber request and cannot make this conditional on additional requirements or fees. If they refuse — file a complaint with NASK. In exceptional situations, NASK can issue the code directly.
Can I lose GA4 data when the agency leaves?
Yes, if you do not have the Administrator role at the account level. An Administrator can add and remove users and delete accounts. If your agency created the account on their account and did not give you the Administrator role, after they leave you may lose access to data. Therefore, before ending cooperation, make sure you have full permissions.
How long does it take to transfer Business Profile ownership?
After adding a new owner, there is a 7-day waiting period before you can manage some functions, including removing other owners. Full transfer of control can take about a week if you include verification and the waiting period.
Do I need to know the password to the previous agency's Google account?
No. Instead of asking for a password, add new users with their own Google accounts. Each user should have their own account — this protects against losing access when someone on the team changes and allows tracking who did what in the system.