A business owner decides to switch agencies. The new agency asks for access to Google Ads, the domain registrar, and the website hosting. The owner asks the old agency. The old agency says the accounts are theirs, the domain is registered in their name, and the website was built on their proprietary platform. The owner's marketing is now a hostage negotiation.
This is not rare. It is the single most common structural problem we find in technical audits, and it is almost always the result of convenience rather than malice. Someone set things up years ago in whatever account was handy. Here is how to check, and how to fix it.
The accounts that matter
The domain. Registered at a registrar (GoDaddy, Namecheap, Google Domains successor, Cloudflare, and so on). Whoever controls the registrar account controls where the domain points, which means they control the website, the email, and every link ever built to you.
DNS. Sometimes at the registrar, sometimes at a separate provider like Cloudflare. Controls which server the domain resolves to and where email is delivered.
Website hosting and the site itself. The server or platform the site lives on, and the code or content. On WordPress that is a hosting account plus the files and database. On a proprietary agency platform it may be nothing you can export at all.
Google Business Profile. The listing should be owned by a Google account the business controls, with agencies added as managers.
Google Ads and Meta Ads. Each should be an account the business owns, with agencies granted access through a manager account. If the ad account was created inside the agency's manager account, the history, the conversion data, and the audiences may not be transferable.
Google Analytics, Search Console, Tag Manager. Same principle. Business-owned property, agency as a user.
Email marketing, SMS, and CRM. Your contact list is an asset. If it lives in a vendor's account, ask what the export looks like before you need it.
How to check in twenty minutes
For the domain, run a WHOIS lookup on your domain. Privacy protection may hide the registrant, but the registrar will be visible. Then try to log in to that registrar. If you cannot, and you do not know who can, that is finding number one.
For DNS, look at the nameservers in the same WHOIS result. If they point to a provider you do not have a login for, note it.
For hosting, ask where the site is hosted and request a login. If the answer is a platform name you cannot log into directly, you do not own the site.
For each Google and Meta property, open it, go to the users or access section, and look for an account in the business's name with the highest permission level. If the only owner is an agency email, that is a finding.
Write down every result in one document. This becomes the access register you maintain from now on.
Taking ownership back
Domain. If it is registered to a vendor, request a transfer to a registrar account you create. Registrars have a standard transfer process; the vendor initiates it, and you accept. A cooperative vendor does this in a day. If they refuse, and you can prove the business has used the domain, a dispute through the registrar or ICANN is possible but slow. Get this done while the relationship is good.
Website. Request a full export: files, database, and any content. On WordPress that is a standard backup. On a proprietary platform, ask what a departing client receives. If the honest answer is "the content as a document," plan for a rebuild and budget accordingly. This is one reason we build client sites on ordinary, portable infrastructure rather than a locked platform.
Ad accounts. If the account was created under the agency's manager, ask them to transfer administrative ownership to an account you control. If it cannot be transferred, create a business-owned account and have the agency work in it from now on. You lose history, which is real, but you stop the problem compounding.
Business Profile. Request ownership transfer from the current primary owner. Google has a process for this, including a path for when the current owner is unresponsive.
The rule going forward
Every account is created in a business-owned login, using a business email address that more than one person can access. Every vendor is added as a manager, editor, or user, never as owner. When a vendor relationship ends, access is removed the same day.
Put two-factor authentication on the business login and store the recovery codes somewhere the business, not one employee, can reach. Losing the owner account to a departed office manager's phone is the second most common version of this problem.
It is also the first thing to settle before a website redesign or a change of agency.
Frequently asked questions
My agency built the site. Do they own the design?
Check the contract. Many agency agreements assign the work to the client on payment; some retain rights to templates or code. If the contract is silent, ask for a written assignment now.
The old agency wants a fee to release the domain.
If the contract does not provide for it, push back in writing. If the fee is small and the alternative is a dispute, paying it may be the fastest way out. Then never let it happen again.
Should I give my new agency owner access to make things easier?
No. Manager access is enough for every legitimate task. If a vendor insists on ownership, ask why.
How often should I re-check?
Once a year, and any time a vendor relationship or a key employee changes.