When a Marketing Agency Controls Your Business Profile: Access Recovery, Evidence, and Reputation Risk

Why an Access Dispute Is More Than a Technical Problem

A business profile is not merely a pin on a map. It can carry public hours, phone numbers, website links, service categories, customer messages, booking links, photographs, review responses, posts, and a history that affects how customers find and evaluate the business. When an outside agency, employee, franchise contact, web developer, or former consultant controls part of that environment, the question is not simply, “Who knows the password?” The questions are who is an owner, who is a manager, which email controls recovery, which accounts are connected, which records show authorization, and what changes have already been made.

The practical stakes can be immediate. A wrong phone number, closed-status edit, missing booking link, unanswered review, duplicate profile, or lost verification path can affect calls and revenue. In a dispute, the parties may also disagree about unpaid fees, campaign work, content rights, website hosting, domain renewal, lead data, advertising accounts, or confidential customer information. Those disagreements may be real, but they do not automatically decide who has authority over a Business Profile or justify unilateral interference with a business's public information.

Google's current guidance is a useful starting point, not a substitute for a contract or legal analysis. Google describes owners and managers as distinct roles, allows multiple owners but one primary owner, cautions against password sharing, and says business owners should retain access when a third party manages the profile. Its agency guidance also contemplates agencies managing client profiles through structured access. The business should therefore document the actual platform role and the relationship behind it before claiming that someone “stole” an account or that a platform must immediately choose a side.

This article is general information and attorney advertising. It is not legal advice, platform-support advice, cybersecurity advice, employment advice, accounting advice, or a recommendation to seize accounts, withhold payment, send a demand, create a new listing, or make a public accusation. The outcome may depend on the platform's current rules, the account history, the parties' agreement, the entity that owns the operating business, the governing law, and the evidence available.

Preserve the State Before Anyone Changes Permissions

The first defensible step is preservation. Capture the public profile as customers see it: the exact URL, business name, address or service area, phone number, website, hours, categories, recent posts, review count, individual reviews, owner responses, booking links, photos, questions, and any warning or suspension notice. Capture the management view too, but keep those materials private. A screenshot alone is often incomplete. Save PDFs, full-page images, relevant emails, account notices, invitation records, and a short collection note stating who collected each item, when, from which account or device, and where it is stored.

Preserve the access screen before removing a person where feasible. Record the primary owner, other owners, managers, pending invitations, business group or agency relationship, and the email addresses shown. Also preserve the business's domain-registration record, website-hosting account, shared inbox information, phone-service account, and any linked advertising, analytics, reservation, CRM, or payment systems that help establish the business identity. Do not put passwords, authentication codes, customer details, or private email content in a public response or an unnecessary demand.

A simple chronology is more useful than an emotional narrative. It might state that the business hired an agency on a certain date; the agency was invited as a manager or owner; the business requested a handoff; an invoice became disputed; profile changes occurred; the business made a platform ownership request; and the business received a response. If facts are uncertain, label them as uncertain. A chronology that distinguishes what is known from what is suspected is stronger for platform support, counsel, an insurer, or a later court than a message asserting bad faith without a record.

Map the Access System, Not Just One Login

Many recovery efforts fail because a team looks only for one Google login. Create an access inventory with separate rows for the Business Profile, the primary owner account, other owners, managers, business groups, agency organizations, domain registrar, website host, email domain, phone system, appointment system, advertising account, analytics account, social accounts, cloud storage, and any reputation-management platform. For each row, record the entity shown as owner, the human contact, the business email used, the recovery method, the last known access date, and the evidence supporting the relationship.

The inventory should distinguish platform authority from commercial authority. An agency might be an owner in the interface yet have a contract requiring it to transfer control at termination. Conversely, a founder may personally hold a login even though the operating company is the contracting party. A family-owned company might have a deceased principal's account as the primary owner, raising separate estate or fiduciary questions. The inventory is not a declaration of legal ownership; it is a fact map that allows counsel and the business to see which handoff steps are feasible.

Google advises that every user have a separate Google Account rather than sharing a password. That practical rule should influence the recovery plan. Asking a vendor to disclose a personal password is neither a clean security practice nor necessarily a useful remedy. The business's better objective is business-controlled owner access, documented recovery contacts, limited manager permissions for vendors, and a regular review of who can change access. Once control is restored, remove unnecessary access only after the relevant records and notices are preserved.

Read the Agency Agreement and Business Records Carefully

The contract may answer questions the dashboard cannot. Review the proposal, master services agreement, statement of work, amendments, onboarding emails, invoices, payment records, termination notice, and any offboarding checklist. Look for language about account creation, credentials, ownership of work product, administrator rights, data return, confidentiality, transition assistance, disputed invoices, suspension rights, limitations of liability, notice procedures, forum, and governing law. Avoid assuming that the word “manage” means the agency may retain control indefinitely, or that a missed payment automatically gives the business a right to take every connected asset without process.

Accounting records should be part of this file because an access dispute can become entangled with a fee dispute. Preserve the invoice, purchase order, proof of payment, scope changes, approval emails, deliverables, credits, refund discussions, and ledger treatment. The IRS describes recordkeeping as a way to monitor business progress, prepare financial statements, identify income and expenses, and support reporting; the same discipline helps establish what services were authorized and what money changed hands. A business seeking help from a best accounting firm for orderly books should keep the accounting review separate from a public reputation response.

Do not alter or backdate records to improve the narrative. Preserve the original agreement and create a separate memo identifying the questions it raises. If the business is a corporation, LLC, partnership, trust-owned enterprise, or estate asset, preserve the corporate records or fiduciary authority that identify who may instruct vendors. A vendor should not have to guess whether a former officer, an executor, a trustee, or a current manager has authority. Clear authority documents can speed a practical handoff.

Use Platform Ownership and Support Routes Precisely

When a verified profile is owned by someone else, Google provides an ownership-request process. Google says a business owner or authorized representative may request access; the current owner is notified and has a limited response period, and an available claim or verification route may follow if there is no response. The process should be used with accurate business identity information, not as a pressure tactic. Preserve the confirmation email, the request date, any denial, and the platform's stated next step.

A request is stronger when it is narrow and organized. Identify the legal business name, public profile, address or service area, the authorized representative's business email, the relationship to the business, and the evidence of authority that the platform actually asks for. Do not overwhelm a support form with private client records, accusations about the agency, unredacted invoices, or unrelated litigation material. The platform needs enough information to evaluate the request; a lawyer may need a fuller file later.

A new profile should not be created merely to bypass a hard handoff. Duplicates can confuse customers, split reviews, trigger platform problems, and complicate proof of the original profile's history. Similarly, an owner should not use access to change the business name, website, phone number, or review responses as leverage in a billing dispute. Platform policy, contract rights, and litigation remedies are different routes. Keeping them separate protects the business's credibility.

Avoid Defamation, Privacy, and Retaliation Traps

The most damaging early mistake is a public accusation. A frustrated owner may post that an agency “hijacked” the listing, tell customers that a former consultant is a criminal, or answer reviews by revealing private negotiations. A factual statement may be defensible in some contexts, but a public accusation can create defamation, business-disparagement, privacy, contract, or interference questions of its own. The safer public message is usually no message at all until the record is stable, or a short customer-facing update that says the business is working to confirm current contact information without naming or blaming anyone.

Privacy matters even if the business believes it has been wronged. The file may contain customer names, emails, bookings, messages, payments, employee records, screenshots, authentication details, and agency staff contact information. Redact before sharing and limit circulation to people who need the material. A public reply to a negative review is not the place to prove that a customer was wrong by posting invoices, booking notes, health-related details, or private correspondence. Glinskylaw's guide to private information in a review response explains why a narrow public reply can be safer than a detailed rebuttal.

Nor should the dispute be used to punish legitimate consumer speech or employee activity. The Consumer Review Fairness Act restricts certain contract terms that suppress consumer reviews, and employment-related posts can raise separate retaliation and labor-law issues. A vendor-access dispute may coexist with a genuine consumer complaint or a worker concern. The business should classify each publication and relationship separately rather than treating every negative statement as part of the agency conflict.

When Preservation Duties and Counsel Review Matter

Not every access problem requires litigation. But certain facts justify a more formal review: a threat to sue, a demand letter, a sudden deletion of customer data, suspected unauthorized profile edits, loss of a core domain or email account, a public accusation of fraud or crime, a regulator inquiry, an insurance notice, a major revenue interruption, or a dispute over confidential information. At that point, routine deletion, auto-archiving, message cleanup, or account changes can become risky. Identify the relevant sources and decide, with counsel if appropriate, what should be preserved.

Federal Rule of Civil Procedure 37(e) addresses certain electronically stored information that should have been preserved in anticipation or conduct of litigation and is lost because reasonable steps were not taken. The rule is not an instruction to keep everything forever, and it does not decide every state-law dispute. Its practical lesson is simple: document a reasonable preservation decision. The file should show when the business recognized a material dispute, what sources were identified, who was told not to delete relevant material, and what practical limits applied.

Legal review can also help decide whether a contract demand, negotiated offboarding, platform request, preservation notice, insurance notice, or court process is proportionate. A demand that overstates the facts can make resolution harder. So can a self-help response that disrupts a public listing or locks out a party before the access record is preserved. The goal is not escalation for its own sake; it is restoring lawful business control while protecting evidence and reducing collateral reputational harm.

A First-Week Checklist for Business Owners

Day one: preserve the public profile and the access screen; identify the operating entity and authorized decision-maker; save the agency agreement and recent communications; and secure business-controlled email, domain, phone, and recovery accounts. Day two: build the access inventory and chronology; collect invoices, payment records, statements of work, and termination communications; and list any connected booking, advertising, analytics, or reputation systems. Keep originals intact and create working copies for review.

Day three: use the applicable platform ownership or support process with accurate information. Day four: send a narrow, professional offboarding request if the contract and facts support it, asking for documented transfer or removal of unnecessary vendor access rather than a personal-password handoff. Day five: decide whether customers need any factual, privacy-safe update because the public contact information is incorrect or a response route is temporarily unavailable. Do not manufacture positive reviews, suppress genuine complaints, or ask staff and friends to post compensating reviews.

At the end of the week, record the current permissions, next platform deadline, outstanding documents, and one owner for the file. After resolution, update the vendor-offboarding procedure: the business should retain an owner role, use company-controlled email addresses, give outside providers limited manager access where appropriate, maintain an access register, and run a quarterly review. A clean access design is less dramatic than an emergency recovery, but it is far more valuable.

Bottom Line

When a marketing agency controls a Business Profile, the business should resist treating a dashboard problem as a public fight. The strongest response begins with evidence: the actual roles, the profile state, the contract, the business records, the platform notices, and a precise chronology. It then uses the platform's ownership process and a documented commercial handoff while keeping legal remedies, accounting questions, customer communications, and public statements in their proper lanes.

The aim is not to promise instant recovery or accuse a vendor without proof. It is to restore a business-controlled access structure, preserve the material that may matter, protect customer-facing information, and give counsel a reliable file if the dispute cannot be resolved commercially. That discipline also helps prevent the next problem: a profile that only one person can control, an agency relationship with no exit plan, or a reputation response that creates a new legal risk.

This article is general information and attorney advertising. It is not legal advice and does not create an attorney-client relationship. Businesses facing a real access, vendor, review, data, or reputation dispute should consult qualified counsel familiar with their facts, contract, jurisdiction, and the platform process involved.