Law Firm Account Ownership: Who Should Hold the Keys?

Own the accounts. Grant the access. That is the entire rule, and it is the one thing most firms get wrong before it ever matters. If you have ever wondered who owns your law firm’s Google Ads account, the answer is whoever clicked “create,” and it is usually not the firm. Law firm account ownership is simple to state: the domain, the hosting, Google Ads, Analytics, Search Console and the Business Profile, all registered in the firm’s name, with your login at the highest permission level. The agency gets manager access to do the work. Nothing above that.

I work with a lot of marketing agencies, and I watch the same failure repeat. A firm hires a shop. The shop registers the domain, buys the hosting, builds the WordPress site, spins up the Ads account and the Analytics property. Every one of those lives under the agency’s email, in the agency’s name. The firm pays the invoices and assumes it owns the thing. It owns nothing.

Then the relationship ends. Firms move their website between vendors every couple of years, and that is normal. Each of those moves turns into a standoff when the vendor is holding the keys.

Who owns my law firm’s Google Ads account?

On Google Ads the mechanics are blunt. If a manager account creates a new account, the manager automatically becomes the owner of that account, and a client account can have only one owner. Linking an existing account works differently, because a linked account does not grant the manager ownership unless the client enables it (About ownership of client accounts).

So the answer turns on one click nobody documented at the time. Whoever created the account owns your campaigns. If that was your agency, you are a guest in your own ad account, and the same question applies to the domain and the analytics property.

A $5,000 ransom is not a hypothetical

Domain consultant Bill Hartzer describes a client whose domain was registered in her former developer’s name rather than hers. When she asked for the transfer, he wanted a $5,000 ransom (Bill Hartzer). Courts have not been kind to that move. In DSPT International v. Nahum, the Ninth Circuit held that using a domain name to get leverage in a business dispute can establish a violation of the Anticybersquatting Consumer Protection Act. The defendant was an employee who registered his company’s eq-Italy.com in his own name, lawfully, then sat on it while he pressed a claim for unpaid commissions. The jury awarded $152,000 (DSPT Int’l, Inc. v. Nahum, 624 F.3d 1213 (9th Cir. 2010)). Registering it was legal. Holding it was not.

The legal-marketing version has the same shape. Picture a divorce firm that has lost its WordPress login entirely, and the party sitting on its hosting and its domain wants five figures to let go. Read that as an illustrative scenario, not a case I can hand you a docket number for. The documented mechanics are the part that should worry you.

It still breaks my heart to see a takeover like that inside my own industry. When the other side controls the hosting and the install, there is nothing I can do from the outside. You cannot rebuild a site you cannot reach. You cannot reclaim an account you never owned.

The 60-day notice clause is a leash

Plenty of agency agreements carry a 60-day cancellation notice. Read it as a pricing mechanism, because that is how it behaves when a firm tries to leave. Two months of notice on a $20,000 retainer is $40,000 owed before anyone performs a day of new work. That figure is arithmetic, not a filed case.

A firm in that position is not staying because the marketing works. It stays because leaving carries a five-figure exit invoice and because its whole digital presence sits inside someone else’s logins. That is not a business relationship. It is a ransom with paperwork.

Google already agrees with me

This is not a contrarian position I invented. It is written into the platform policies your agency agreed to.

Google’s Business Profile third-party policy states that all end customers must retain ownership or co-ownership of their Business Profile at all times, and it lists keeping a profile hostage in exchange for money as a prohibited practice. The same policy gives a third party seven business days, from the customer’s notice, to disassociate the account and let the customer regain exclusive control (Google Business Profile third-party policies). An agency that will not hand your profile back is not driving a hard bargain. It is out of policy.

Money has rules too. Google’s transparency requirements for third parties say they must report the exact amount charged by Google, exclusive of any fees the third party charges, and disclose that management fee in writing before the first purchase and on every invoice. They must also give you your customer IDs on request, so you can contact Google directly (transparency requirements, Google third-party policy). If your agency pays Google out of its own account and you have never seen the raw Google charge, you have a markup problem stacked on an ownership problem.

And the exit clock is already specified. Google’s Ads API policies give a third party three business days from a client’s notice to let that client disassociate from its services and developer token, then regain exclusive control of the Ads accounts (Google Ads API policies). That clause binds parties building on the Ads API, so it may not reach an agency that works only in the interface. It is still the number Google picked when it had to pick one.

What you lose when you do not own the account

Most principals think the loss is a login. The loss is the history.

The 90 days of Quality Score you funded

Quality Score is scored per keyword against other advertisers who competed for the same keyword over the previous 90 days, built from expected click-through rate, ad relevance and landing page experience (About Quality Score for Search campaigns). That performance record is account-scoped. Start fresh in a new account and you are bidding as an unknown, with none of the behavioral evidence you funded.

The same goes for the conversion history automated bidding learns from, for remarketing lists built over years, for the negative keywords someone discovered one wasted click at a time, and for the audiences you spent a year narrowing. The PPC community has chewed on this question publicly and landed where I do: the client owns the account, the agency manages it. Settle it before you need it, because the alternative is rebuilding from zero when the old shop will not release what you paid it to build (PPC Hero).

Analytics, where the damage turns structural

Search Engine Journal documented an agency running more than 68 client domains through a single Universal Analytics tracking code, which meant no client could take its own data when it left (Digital Extortion). On March 6, 2026, a former agency that had kept access for six years closed its own Google account and wiped a client’s Merchant Center with it: primary feeds, feed rules, supplemental feeds, and every account link it still held. The agency’s super admin rights had never been revoked. Emmanuel Flossie of FeedArmy, a Google Ads Diamond Product Expert, documented what happened and got the account restored inside 24 hours. That was luck, not design (PPC Land).

The domain is the sharpest edge

Under ICANN’s Transfer Policy, a registrar transfer requires express authorization from the Registered Name Holder or the administrative contact, so if your developer’s name sits in that field, your developer decides (ICANN Transfer Policy).

Fashion brand Bronx and Banco sued its web developer in 2026, alleging it was cut off from bronxandbanco.com, the matching .com.au, its back-office software and its company email when it tried to switch firms. The .com was then listed on Afternic at $50 million. The developer’s answer was that the domain had been on a lease-to-own plan through a broker rather than owned outright (Domain Name Wire).

In June 2026, Palo Alto cybersecurity company System Two Security sued its former field CISO, Andy Mog, over detections.ai. That domain carried its website and every company email address. Mog registered it on the company’s behalf while employed there, then refused to surrender the credentials after he was terminated, the complaint alleges. The filing quotes his reply to the CEO: “You should have known better, Robert. You know I like to buy domains.” The parties are now in a standstill, pursuing arbitration (Domain Name Wire).

It gets darker than civil court. Travis Tso held his Phoenix employer’s GoDaddy login. When the company asked for it back in 2015, he said he no longer had it. Then he altered the contact details, broke the site and email, asked for $10,000, and pointed the domain at a porn site when the company refused. He was sentenced in September 2017 to four years of probation and $9,000 in restitution (Domain Name Wire).

None of those are law-firm cases. I have not found a verified, named hostage case against a law firm, and I am not going to invent one. The mechanism does not care what your practice area is.

The model that works

The firm owns every account. The firm pays Google and Meta directly for media, with no markup hidden inside a blended invoice. The agency bills its management fee separately and openly.

When you hire someone new, give them access to your existing accounts instead of letting them start clean inside their own manager. New vendors like a fresh build because it is tidy for them. It costs you every month of learning and history you have already paid for. This is also why I argue that search and intake belong to the same operator rather than three vendors who each own a piece of your login list.

Put it in the contract

Default copyright law does not favor you. Work commissioned from an independent contractor is owned by the contractor unless there is a written work-made-for-hire agreement that fits one of the statutory categories, or a written assignment of copyright (FindLaw, Ownership of Copyrights). Silence hands the work to whoever built it.

So name the assets. Your agreement should list the domain, hosting, Ads accounts, analytics properties, Search Console, the Business Profile, social profiles, call tracking numbers and CRM data as the firm’s property, and include a transition clause with a hard deadline for admin handover plus full data exports. Borrow Google’s own clocks: three business days for ad accounts, seven for Business Profiles. I am not a lawyer and this is not legal advice, so have your own counsel draft the language.

Why I do not use contracts

Here is my own practice. I do not do contracts. If a firm decides I am not earning my keep, they are free to leave, and I hope they send the next firm my way.

I can work that way because I hold nothing. The accounts are theirs. Leaving is easy, which is exactly why most stay. An agency that needs a 60-day clause to keep you is telling you something about its product.

The law firm account ownership audit

Run this before you sign with anyone, and run it today if you are already under contract.

• Your domain is registered in the firm’s legal name, with a firm email as registrant contact, and you can log into the registrar yourself.
• Your hosting account is in the firm’s name, billed to the firm’s card, and you hold the credentials.
• You hold the owner or top-level admin role in Google Ads, Analytics, Search Console and the Business Profile, and the agency appears as a manager, not an owner.
• You pay Google and Meta directly, and you can see the exact amount Google charged.
• Your contract names the accounts as firm property and states what you take with you on exit.
• You have a current export of your CRM and call recordings sitting somewhere the agency cannot reach.

If any line comes back “no,” fix it while the relationship is still good. Nobody has ever won this argument during a breakup. And if the site itself is the asset you cannot afford to lose, the conversion checklist is the other half of this conversation, because an owned site that does not convert is just a well-titled liability.

If this is your problem

Ownership is the cheapest insurance in legal marketing, and it costs nothing but a few hours of account administration while everyone is still friendly. Most firms I talk to have at least two assets registered to someone else and have never checked which two.

If you want to know where your keys actually sit, write me at hi@carlosarias.com. I will tell you what I find, including the parts that are fine. Some of the same thinking shows up in why firms keep firing agencies.