Every agency conversation eventually reaches the same sentence: "Can you give us access to your accounts so we can take a look?" And every owner feels the same small flinch. You barely know these people. You have read the horror stories about agencies that ran off with an account, or quietly torched a budget. Handing over control before you have signed anything feels backwards, because it is.
So don't. You do not have to choose between "no audit" and "full control to a stranger." There is a middle setting built into every major ad platform, and it exists for exactly this moment: read-only access, sometimes called view-only or Analyst access. It lets an agency read everything in your account and lets them change nothing. No campaigns edited, no budgets touched, no money spent, no users added. They look. That is the entire permission.
This guide walks through how to grant that view-only access on the four accounts an audit actually reads: Meta (Facebook and Instagram), Google Ads, Google Analytics 4, and TikTok if you run it. Each one takes a minute or two. None of them requires a contract, and none of them requires your password. When the audit is done, you revoke access in one click and your account is exactly as you left it.
Why read-only is exactly right before you sign
Read-only access is the honest version of "let us take a look." It gives an agency enough to prove they know what they are doing, and it gives you a hard guarantee that they cannot do anything while they are in there.
Here is what "read-only" actually means at the platform level. The agency is granted a role that the platform itself enforces. On Meta it is called Analyst. On Google Ads it is called Read-only. On Google Analytics it is Viewer. On TikTok it is Analyst. In every case the platform physically blocks the edit buttons. If someone with view-only access tries to change a campaign and hit publish, they get an error. This is not a promise from the agency. It is a rule from Meta and Google that the agency cannot override.
That distinction matters, so it is worth being blunt about the three ways an agency can "get access," because only one of them belongs before a contract:
- Your password. Never. If an agency asks you to share your login so they can "log in and look," that is a red flag, not a convenience. It means they are not set up to work through the proper business tools, and it puts your identity and every account tied to that login at risk.
- Full management access. This is the real, legitimate access an agency needs to run your campaigns: build, edit, pause, and spend against a budget you approve. It is the right setting once you have signed and decided to work together. It is the wrong setting for a first look.
- Read-only access. The agency reads. The agency cannot edit, spend, add users, or lock you out. This is the correct level for an audit, every time.
Read-only access is a guest pass to look at your data, not a key to your account. You stay the owner. You stay in control of every dollar. And you can take the pass back the second you want to, with nothing lost.
One of the most cautious owners we have worked with spent weeks stuck on exactly this before he would grant access. He did not want us able to touch anything, and he was worried that letting a third party look would strain his existing agency, which a business partner of his had referred. Read-only solved the first fear on its own: we physically could not change a thing, and he could verify that himself. The second came down to honesty. We told him to be upfront with his partners, that he simply wanted an outside read on the account to find pockets of improvement, nothing more and nothing less. He did, every party was fine with it, and the audit went ahead without touching a single relationship.
What an audit needs to see (and what it does not)
A good audit is a reading exercise. We are pulling your last few months of spend, conversions, and campaign structure to answer specific questions: where is money leaking, is your tracking even telling the truth, and where is the fastest gain. To do that, we need to see a handful of things. We do not need to hold any of them.
Setting expectations up front tends to dissolve most of the worry, so here is the exact split.
| An audit needs read access to | An audit never needs |
|---|---|
| Your ad accounts on the platforms you run (Meta, Google Ads, TikTok) | Your password or login credentials |
| Your Google Analytics 4 property, for conversions and on-site behavior | Admin or business-owner role on any account |
| Historical performance data, so we can see what has and hasn't worked | Control of your billing or payment methods |
| Your conversion tracking setup, to check whether it is accurate | Your Shopify admin or store back end |
Read the right-hand column again, because it is the reassuring part. An audit does not touch your billing. It cannot spend. It does not need ownership of anything, and it has no business inside your store admin. If any of that comes up as a requirement for a free audit, ask why.
Before you start: a 3-minute checklist
The only thing that slows this down is discovering mid-way that you do not have the rights to grant access on one of your own accounts. Two minutes of checking now saves a frustrating back-and-forth later.
- Confirm you are an admin. On each platform you plan to share, make sure your own login has admin or owner rights. Only an admin can add someone else, even at view-only. If your accounts are run by an in-house marketer or a freelancer, they can grant the access instead, and it does not disturb their own.
- List what you actually run. Note which of Meta, Google Ads, and TikTok you have live, plus your GA4 property. You only share the accounts that exist. There is no need to spin anything up for an audit.
- Have the agency's details ready. For Meta, Google Ads, and GA4, you will need the email address the agency gives you. For TikTok, you will need their Business Center ID. A legitimate agency sends these from its own company email. We send ours from a
@pedal-performance.comaddress.
Meta (Facebook & Instagram): add us as an Analyst
Meta's view-only role is called Analyst. An Analyst can open Ads Manager, read every campaign, and pull reports. They cannot edit a campaign, change a budget, or publish anything. It is the cleanest read-only setting of the four platforms.
Step 1: Open your ad account settings
Go to business.facebook.com/settings and, in the left rail, open Accounts → Ad accounts. Select the ad account you want us to audit. (If you manage ads through Meta Business Suite instead, open Settings → Ad accounts there. Both paths land in the same place.)
Step 2: Add the agency's email
With your ad account selected, click Add people and enter the email address we send you during scheduling. If Meta does not recognize the email yet, it may first ask you to add the person under Users or People, then bring you back here to assign this ad account. Either path ends in the same place, and Meta invites that person to your ad account specifically, not to your whole business.
Step 3: Choose the Analyst (view-only) role
Meta will ask what this person can do. Choose Analyst, the view-only option that turns on reporting and viewing and leaves every editing permission off. Depending on your Business settings version, this appears either as a named Analyst role or as a set of view-only toggles under partial access. Either way, turn on viewing and reporting only, and leave every editing permission off. Save, and the invite goes out. Once we accept, we can see your account. We still cannot change a thing in it.
Do not pick "Manage campaigns" or grant admin. Those are full-control settings for an agency you have hired to run the account, not for an audit. For a first look, Analyst is the only role you need.
Google Ads: invite us at Read-only
Google Ads has a dedicated Read-only access level, and it is exactly what it sounds like. A read-only user can browse your campaigns, view performance, and open reports. They cannot edit campaigns, change budgets, add payment methods, or manage users. Google enforces it.
Note that this is different from the manager-account (MCC) link we would set up if you later hire us to run the account. That is covered in our full agency-access guide. For an audit, you simply invite our email at the read-only level. It is faster and it grants less.
Step 1: Open Access and security
Sign in at ads.google.com with an account that has Admin rights (only admins can invite users). Click the Admin icon, then choose Access and security.
Step 2: Invite the agency by email
Click the + button to add a user and enter the email address we provide. Google will show a list of access levels: Admin, Standard, Read-only, Billing, and Email-only.
Step 3: Select Read-only and send
Choose Read only, then click Send invitation. We accept from our side, and access is live the moment we do. Here is precisely what that level allows and blocks:
| Read-only can | Read-only cannot |
|---|---|
| View campaigns, keywords, and settings | Edit or create campaigns, keywords, or ads |
| View and run performance reports | Change budgets or bids |
| View billing information | Add or change payment methods |
| Use planning tools to look at opportunities | Add, remove, or manage other users |
Google Analytics 4: add us as a Viewer
Your ad accounts show what happened inside the ad platform. Google Analytics 4 shows what happened after the click: which pages people landed on, what they did, and which conversions actually completed. An audit leans on GA4 to sanity-check whether the conversions your ad platforms report match reality. Half of the tracking problems we find only show up when you compare the two.
GA4's read-only role is Viewer. A Viewer can see all the reports and data in the property and change none of the configuration.
Step 1: Open Property Access Management
Go to analytics.google.com, select the property you want audited, and click Admin (the gear icon at the lower left). In the Property column, click Property Access Management.
Step 2: Add the agency email as a Viewer
Click the + in the top right and choose Add users. Enter our email address. Under Direct roles and data restrictions, select Viewer. That is the read-only role. You can leave the "Notify new users by email" box checked so we know it is ready.
Step 3: Confirm
Click Add. Access applies to that single property and nothing else in your Google account. As with everything else here, it is view-only and you can remove it whenever you like.
TikTok (if you run it): Business Center view-only
If you advertise on TikTok, the read-only path runs through Business Center, and TikTok's view-only permission is again called Analyst. An Analyst can view the ad account and its reporting and cannot change campaigns or settings. Only skip this section if you do not run TikTok ads at all.
Step 1: Add us as a partner first
Sign in at business.tiktok.com as a Business Center admin. In the left menu, open Partners and click Add partner. Enter our Business Center ID, which we send you during scheduling. This connects our Business Center to yours. On its own it grants access to nothing, so it is a safe first step.
Step 2: Share the ad account with us
Now open Accounts, go to the Advertiser accounts tab, and select the ad account you want audited. Choose the option to share it with a partner, and pick us from your connected partners.
Step 3: Set the permission to Analyst
When TikTok asks which ad account permission to grant, choose Analyst. That is the view-only level. Confirm, and we can read your TikTok account without the ability to touch a campaign.
Other platforms, briefly
Most SMB audits live entirely on the four accounts above. A couple of others come up occasionally, and the same principle holds: grant the lowest role that lets us look.
- LinkedIn Ads and Microsoft Ads. Both support a viewer-style role. On LinkedIn, add us to your Campaign Manager account as a Viewer. On Microsoft Advertising, invite our email at the Viewer access level. Same idea as Google Ads read-only.
- Shopify, only if you sell online. An audit does not need your Shopify admin. If tracking questions require a look at the storefront, that is a limited-scope, view-oriented collaborator request (think Reports or a scoped staff view), never full admin. It is genuinely optional for a pre-contract audit, and we will tell you if it is even relevant to yours.
How to revoke access after the audit
This is the part that should put the last of the worry to rest. Removing us is faster than adding us, it is one action per platform, and it is instant. You are never locked in, and nothing about your account changes when we leave.
- Meta: Business Settings → Ad accounts → your account → find our name under people, and click Remove.
- Google Ads: Admin → Access and security → find our email and click Remove access.
- Google Analytics 4: Admin → Property Access Management → select our email → Remove.
- TikTok: Business Center → the shared ad account → Partners → stop sharing with our Business Center.
The moment you do any of these, our view goes dark. Your campaigns, your history, your budgets, and your settings sit exactly where they were. There is no data to claw back, because there was never any data to take. We were reading it inside your account the whole time.
What you get back from the audit
View-only access is enough for a genuinely useful audit, because an audit is diagnosis, not surgery. Reading your account tells us almost everything we need to know about how it is performing and where it is bleeding. Within a few business days of getting read-only access, you get a written summary covering three things:
- A waste audit. We pull your recent spend and flag the campaigns, audiences, and keywords that have been quietly losing money. This is usually the line that makes owners sit up, because the wasted spend tends to be larger than they expected and safe to redirect.
- A tracking and pixel audit. We check whether your conversion tracking is actually telling the truth. A large share of the SMB accounts we audit have broken or duplicate conversion events, which quietly distorts every optimization decision the platform makes. This is often the single most valuable thing a read-only pass surfaces.
- An opportunity map. The specific, prioritized moves we would make first: what to pause, what to test, and where the fastest gains are. You keep this whether or not you hire anyone.
Every account is different, because the structure and naming come from whoever ran it last, so I am never hunting for one specific problem. I am hunting for the same three wins: cleaner data, better efficiency, and room to scale. On a Google Ads account, the first place I look is the conversion events, because more often than not a single campaign is optimizing toward several primary conversions at once. The more primary conversions you pile onto one campaign, the less effective it gets, a bidding tug of war with the algorithm pulled a different way by each one. Next are the settings and data feeds: whether the account is quietly tapping lower-quality traffic, and whether the bidding strategy actually fits the structure and quality of the data behind it. Last I pull the keywords all at once instead of campaign by campaign, because that is the fastest way to catch multiple campaigns or ad groups bidding against each other for the same searches. The same pattern shows up on Meta, where overlapping audiences quietly put your own ad sets in competition for the same people. Problems like these are more common than most owners expect, usually easy to fix, and they clean the data and lift performance at the same time.
If you want to see the shape of a real one before you book, these two reads help: the five questions a real audit answers, and how to read a paid search audit so you can tell a real one from a checkbox exercise.
A lot of the read-only analysis runs through Hopkin, our in-house AI marketing copilot. It reads the same account data you just granted view-only access to and surfaces the waste and tracking gaps quickly, which is part of why the turnaround is days, not weeks. Learn more about Hopkin →
When you're ready to move forward
If the audit lands and you decide to work together, upgrading access is a small, deliberate step you take on purpose, not a switch that flips on its own. Read-only never quietly becomes full control. To actually run your campaigns, we would ask you to grant management access, and that is its own clear process: the Manage role on Meta, an MCC manager link or Standard access on Google Ads, Operator on TikTok.
We wrote that whole flow up separately, so you can see exactly what changes and what stays the same: how to connect your ad accounts to an agency manager. Even at that level, the core principle from this guide does not move. You stay the owner of every account, and you can revoke access in one click.
Here is the honest version. If an agency is any good, read-only is all it needs to prove it. Give us a view-only look and a few days, and the audit should show you enough specific, real value that going further becomes an easy decision. We do not need control of your account to earn your trust, we need to earn it first. So if an agency pushes for full management access before you have signed anything, treat it as a signal. Either they are not set up to work through the proper tools, or they want a hold on your account before they have shown you a single result. A good partner is happy to start with a guest pass and let the work do the talking.
Frequently asked questions
Is read-only access safe? Can the agency change or spend anything?
Yes, it's safe. Read-only (also called view-only or Analyst) is a role every major ad platform builds in specifically so someone can look without touching. The agency can open reports and read performance, but the platform blocks them from editing campaigns, changing budgets, moving money, or adding users. There is no card to charge and no button they can press that costs you anything.
Do I have to sign a contract to get the free audit?
No. The whole point of read-only access is that it happens before any agreement. You grant view-only access, we audit, we show you what we found, and only then do you decide whether to work together. If you don't move forward, you revoke access and nothing changes about your account.
Will the agency see my historical data?
Yes, and that is exactly what makes the audit useful. View-only access lets us read your past spend, conversions, and campaign history so we can tell you where money has been wasted and where the opportunities are. None of that data leaves your account. We are reading it inside the platform, not exporting it.
What is the difference between read-only access and full agency access?
Read-only lets an agency look but not touch, which is all an audit needs. Full management access (Manage on Meta, Standard or Admin on Google, Operator on TikTok) lets them build and edit campaigns and spend your approved budget. You only grant management access after you sign, if you decide to work together. The two are separate steps, and read-only never silently becomes full access.
How do I revoke access after the audit?
One click per platform, and it is instant. On Meta you remove the person from the ad account. On Google Ads and GA4 you remove the email from the access list. On TikTok you stop sharing the asset with the partner. The moment you do, the agency can no longer see anything, and your account, history, and settings are untouched.
Do you need my password?
Never. Every step in this guide grants access to our own separate business identity or email. Your login stays yours and is never shared. If any agency asks for your password to run an audit, treat it as a red flag: it means they are not set up to work the right way.
What if my account is run by an in-house person or a freelancer?
Whoever has admin or owner access on the account can grant view-only access in a few minutes using these steps. You don't need to change any ownership or take anything away from them to get an audit. Read-only sits alongside their existing access without disrupting it.
How long does the audit take?
Granting access takes about five minutes if you have admin rights. From there, most audits come back within a few business days. You get a written summary of wasted spend, tracking issues, and the biggest opportunities, with no obligation to continue.