Quick answer: The business must hold primary ownership of every Google Business Profile in an account it controls permanently. Agencies get manager access, granted and revocable by the business. Before any transition, inventory profiles, users, verification states and linked properties, capture a data baseline, then add and remove access one user at a time with verification at each step.
Why profile governance is a business risk, not an SEO task
A Google Business Profile is frequently the single highest-converting asset a local business owns. It carries the reviews, the calls, the direction requests and the hours customers rely on. It is also, in a surprising number of businesses, controlled by a personal Gmail account belonging to someone who left in 2021, or by a marketing agency the company no longer works with.
That is not a ranking problem. It is a control problem, and it surfaces at the worst possible time: during a vendor change, a rebrand, an address move, or a suspension that requires owner-level action. The remedy is ordinary operational hygiene, applied before it is needed.
The roles, precisely
Google's current Business Profile documentation defines a small set of roles, and the distinctions matter for delegation:
- Primary owner. One per profile. Can transfer primary ownership, add and remove owners and managers, and remove the profile. This is the role the business must hold.
- Owner. Broad control including user management, but cannot remove the primary owner. Appropriate for a second trusted internal account as redundancy.
- Manager. Can edit profile information, post updates, respond to reviews and view performance data, but cannot manage users or remove the profile. This is the correct level for almost every agency and most staff.
Two rules follow. First, grant the lowest role that lets someone do their job — a partner managing posts and reviews does not need the ability to remove other users. Second, keep at least two internal accounts with owner-level access, so a single lost password or departed employee never locks the business out.
Business-controlled ownership, in practice
"The business owns it" only means something if the owning account survives staff turnover. A defensible setup looks like this:
- Primary ownership sits on a company-domain account, not a personal Gmail and not an agency address.
- That account is a role-based address the company controls, with credentials in the company password manager and recovery details pointing at company-controlled contacts.
- Two-step verification is enabled, with recovery codes stored where more than one person can reach them.
- A second internal account holds owner access as redundancy.
- Every external party holds manager access, individually named — never a shared login.
Shared logins are the pattern to eliminate first. They defeat the audit trail, they cannot be revoked selectively, and they make it impossible to tell who made a change. Named users cost nothing and solve all three problems.
Onboarding an agency without handing over control
A clean onboarding sequence, in order:
1. Verify your own position first. Confirm you are the primary owner and that you can sign in to that account independently. If you cannot, stop and fix that before granting anyone else anything.
2. Capture a baseline. Record the current profile state: categories, description, hours, services, products, attributes, photo count, review count and average rating, plus recent performance figures. Screenshots plus an export are enough. This is what you will compare against later if something changes unexpectedly.
3. Add the agency as a manager. Use individually named accounts for the specific people who will work on the profile. Avoid granting owner access as a default courtesy; escalate only if a specific task genuinely requires it, and consider reverting afterwards.
4. Plan around the access waiting period. Google applies limits to newly added users on some profiles — commonly around seven days before a new user can take certain sensitive actions such as managing other users. This is expected behaviour, not a fault. Schedule onboarding so the first week covers audit and planning rather than tasks that require full permissions.
5. Agree a change log. Every profile edit gets recorded: what changed, when, by whom, and why. Profile changes affect visibility and can trigger review or suspension, and without a log you cannot correlate a drop with the edit that caused it.
6. Define escalation. Who acts if the profile is suspended, if a fraudulent edit appears, or if a review dispute requires owner action. Decide this while nothing is on fire.
The inventory every business should hold
Whether or not a transition is imminent, maintain one internal record covering:
- Every profile, with its business name, address or service area, and verification status.
- The primary owner account for each, plus all owners and managers with their roles and the date access was granted.
- The profile's place identifier and its public Maps URL.
- Linked properties: Google Ads accounts, Search Console properties, analytics, reservation or ordering integrations, and any third-party listing management tool with API access.
- Categories, services, products and attributes as currently set.
- Review count and rating at the last audit date.
- The internal person accountable for each profile.
For a single location this takes twenty minutes. For thirty locations it is the difference between an orderly transition and a month of archaeology. Multi-location operators should hold profiles through a business group or organisation-level structure rather than a pile of individual accounts, and should keep location-manager access scoped to that manager's own locations. The site-side architecture for that footprint is covered in our guide to multi-location local SEO for Metro Vancouver.
Offboarding a departing agency
Order matters, because removing access before confirming your own is how businesses lock themselves out.
1. Confirm your primary ownership and that you can sign in without the departing party's help.
2. Capture a full data baseline of the current profile state and recent performance before anything changes. If a dispute arises later, this is your evidence.
3. Export what you will lose access to — performance data, review history, post history, photos you may not hold originals of.
4. Remove users one at a time, verifying each removal before moving to the next. Removing several at once makes it harder to notice that one removal failed.
5. Rotate shared credentials. Any password the agency knew is now compromised for governance purposes, even in the friendliest separation.
6. Audit third-party integrations. Listing management platforms, review-request tools and API integrations frequently retain access after the human users are removed. Check for them explicitly.
7. Re-audit a week later. Compare against the baseline and look for edits, category changes, hour changes or removed photos that nobody authorised.
When you have lost access
If a profile is verified and controlled by someone unreachable, Google provides a process to request access: you sign in with the account you want to use, attempt to claim the profile, and Google notifies the current owner, who has a window to respond. If they do not respond, you may be able to claim it. Requirements and timelines are set by Google and change; check the current official documentation rather than relying on remembered steps.
Two realistic expectations. The process takes time — days at minimum, sometimes longer — so it is not a solution to an urgent problem. And documentation helps: evidence that you operate the business, that the profile represents it, and that the existing contact is no longer associated with it strengthens the request. Which is another argument for holding the inventory above before you need it.
Why this shows up in reporting rather than in queries
Governance work rarely produces its own search demand, and it is worth being honest about that. When we checked our own first-party Search Console data for the July 17 to August 13, 2026 window — 62 clicks and 113,846 impressions sitewide, 0.054% click-through rate, average position 31.21 — the filter for Google Business Profile ownership and access queries returned zero matching query rows.
That is an observation about this site in this window, not a statement about market demand. Operational questions like this are frequently asked in conversations, support channels and vendor negotiations rather than typed into search, and search-volume tools were not available for this analysis, so no volume, difficulty or traffic estimate is offered here. The reason to write it down is that the cost of getting it wrong is measured in lost profile control, not in missed impressions.
The short version
Hold primary ownership on a company-controlled account with two-step verification and internal redundancy. Give agencies named manager access, not ownership. Keep an inventory of profiles, users, verification states and linked properties. Log every change. Plan onboarding around new-user access limits. On exit, confirm your own access first, baseline the data, then remove users one at a time and audit the integrations nobody remembers.
If you would like a review of your profile governance alongside your local visibility, our local SEO services include the access audit, and you can contact us for a free consultation.
