Google Ads access levels: admin, standard, read-only, billing

This guide is built from Google's own pages: About access levels in your Google Ads account, Manage access to your Google Ads account, About Multi-party approval, 2-Step Verification, Manager account security mandates and Transfer ownership of a Google Ads account. It covers the access a person has inside one Google Ads account. The levels inside an agency's manager account, and manager ownership, are in our manager account guide.

The five access levels

Every person you add to a Google Ads account signs in with their own Google Account and gets one access level. Google puts it this way: Each time you grant access to your Google Ads account, you can select the features a user can impact by assigning an access level. There are five:

• Admin: everything, including who has access, which managers and products are linked, and advertiser verification.
• Standard: view and edit campaigns, run reports and handle billing, but not users, manager links or product links.
• Read-only: view campaigns, use the planning tools and run reports, without editing campaigns.
• Billing: billing information, payments and billing reports only; no campaigns.
• Email-only: receives notification emails and reports, and nothing else in Google's table.

What each level can do

This is Google's table from the access levels page, with the rows in the same order. "Yes" means Google ticks the box for that level.

Two details are easy to miss. Read-only users can see the user list and the linked managers, and can give someone email-only access. And Billing users do not get the notification emails and reports that the other levels receive.

What only an admin can do

The bottom of the table is admin-only: adding and removing users and changing their levels, accepting or rejecting a manager's link request, unlinking a manager, adding or removing product links (such as Google Analytics for importing conversions), seeing each user's sign-in method and last login, and advertiser verification. Google also asks for Admin access when you set up monthly invoicing or apply for a credit line.

Google warns about accounts with one admin: If your account has only one administrator, you may lose access to your tags if that user becomes unavailable. It suggests adding at least one more admin, and shows a Tag Diagnostics notification when an account has only one.

Billing access and the payments profile

Inside Google Ads, users with Admin or Billing access can update the payments profile: name and address, tax ID, language preference, and forms of payment. Google says they can do this even if they aren't Payments profile users, and that payments admins get an email when a Google Ads user changes the profile.

What they cannot do from Google Ads is manage the payments profile's own users. Google says changes to payment users go through Google Ads support, requested by the primary contact on the payments profile or someone in the same company domain, with the Payments profile ID and each person's name, Google Account email, phone number and the permissions they need.

Inviting, changing and removing users

The person you invite needs a Google Account; if they do not have one, they create one. Everything happens under Admin > Access and security:

1. Select the plus button.
2. Enter the person's email address and choose the access level.
3. Select Send invitation. You get a notification once they accept, and you can withdraw a pending invitation with Revoke in the Actions column.

The invitee accepts from the link in the email. If you invited an address they have set as an alternate email on their Google Account, they can accept with either that address or their primary one, and sign in with their Google Account password.

To change a level, hover over it in the "Access level" column and pick another from the arrow. To remove someone, select Remove access in the Actions column.

Multi-party approval

Multi-party approval is Google's check against a hijacked admin login. Sensitive actions like adding a new user, removing an existing user, or changing user roles will require approval from a second administrator to complete. Read-only roles and API users are exempt. Linking an existing, independent account to a manager account also needs a second admin's approval.

• The request goes to the admins in the account's hierarchy, including admins of linked manager accounts, and any admin can approve it.
• Approvers review it under Admin > Access and security, in the Security requests tab or with Review request in "Pending invitations", then choose Approve or Deny.
• A request not acted on within 20 days expires and is rejected; you start again if the change is still needed.
• Google Ads support can’t approve or deny the request for you, so you need to reach your other admins yourself.

Google's page says multi-party approval applies to accounts with more than 3 administrators, and that it pauses, cancelling pending requests, if an account drops to a single admin.

2-Step Verification

With 2-Step Verification, signing in takes your password plus a second step: a call, the Google Authenticator app, a Google prompt on your phone, a security key or a text message. Google says the Authenticator app is more secure than SMS. To turn it on, go to Admin > Access and security, open the Security tab, and under "Verification during sign-in" turn on 2-Step Verification.

Two practical points from Google's page. Support often asks you to complete 2-Step Verification to confirm who you are, so keep your second method to hand. And if you change phones, move your Authenticator codes to the new phone, or you may be locked out. Changes to recovery details such as your phone number can take up to 7 days to reach Google Ads.

Access through a manager account

An agency usually works through its own manager account rather than as users of yours. Once you accept a manager's link request, admin users of that manager account can receive your notification emails and manage your campaigns. If the manager has ownership of your account, its admins can also edit your users, managers and product links. Our manager account guide explains ownership, the manager's own access levels and unlinking.

A manager with ownership can also set security mandates for the accounts it owns: requiring 2-Step Verification (or Advanced Protection) from a chosen date, which defaults to 7 days ahead, and restricting which email domains can be invited. Google notes these are minimums; each account can set stricter rules.

Handing an account to someone else

Google's access table has no owner level above Admin, and its transfer page does the handover with the Admin level:

1. In Admin > Access and security, Users tab, select the plus button.
2. Enter the email address of the person taking over. It must match their Google Account email.
3. Choose Admin and send the invitation. They follow the email to complete the transfer and then appear on the Users page.
4. Remove yourself with Remove access next to your own email address.

If the account is billed through an agency's manager account on monthly invoicing, moving it to another agency is a billing transfer called Change Who Pays, started by an admin of the current paying manager. The new agency has 7 days to approve before the request is cancelled. Our guide to what you should own lists the other accounts to take back when a supplier leaves.

Which level we would give whom

This section is our suggestion, based on Google's rules above, not something Google prescribes.

• Keep at least two admins from your own business, each on their own Google Account with 2-Step Verification. That avoids the single-admin tag warning and gives multi-party approval a second person to ask.
• Give an agency access through a link to its manager account, and decide on purpose whether it needs ownership. If it works as a user instead, Standard covers campaign work.
• Give a bookkeeper Billing, a manager who only watches results Read-only, and anyone who just needs the reports Email-only.
• Review the Users list and linked managers a few times a year, and remove people who have left. Admins can see each user's sign-in method and last login there, and the change history shows who changed what.
• Never share one login between several people; the access levels exist so that you do not have to.

If a login is ever taken over, our guide to a suspended Google Ads account covers Google's steps for compromised accounts.

Frequently asked questions

What is the difference between Admin and Standard access in Google Ads?

Both can edit campaigns and billing. Only Admin can add, remove or change users, accept or unlink manager accounts, add product links, link Google Analytics for conversion imports and complete advertiser verification.

Can a read-only user make changes?

Not to campaigns or billing details. Google's table lets read-only users run and edit reports, view users and links, and grant email-only access.

Who owns a Google Ads account?

Within an individual account, the admins hold the highest access level, and Google's transfer page hands an account over by adding a new admin and removing the old one. A manager account can additionally be given ownership of a client account.

Does the person I invite need a Gmail address?

They need a Google Account, which can use another email address. Google says the invitee must have a Google Account or create one.

Can Google support approve a multi-party approval request for me?

No. Google says support can't approve or deny it; another admin of the account or its manager hierarchy has to, within 20 days.

The same care with logins applies to your website, domain and hosting. See our Google Ads basics guide, our website maintenance service and all our services, or read the rest of our guides.