# How to outsource analytics without losing control of your data

**Author:** Piotr Litwa - GTM & Analytics Specialist  
**Published:** 2026-11-06  
**URL:** https://piotrlitwa.com/articles/en/outsource-analytics.html  
**Language:** en  
**Keywords:** outsource analytics, analytics outsourcing, gtm user permissions, ga4 access roles, agency owned gtm container

---

You can outsource analytics safely if you keep one rule. Every account lives in your organization. The provider is a guest with the smallest access that gets the job done. That means your GA4 property, your GTM container, your Google Ads account, your BigQuery project and your Meta business portfolio, all created by you, all with you as the administrator.

Everything else in this article follows from that. Access levels, docs, versions and the exit clause keep that rule true for years. People will change on both sides. The rule shouldn't.

> **Key Takeaways**
> - Ownership comes first. If an agency created your GTM container in its own account, you don't own your tracking. You rent it.
> - Give providers the lowest access level that works: Edit in GTM, Editor or Marketer in GA4, Standard in Google Ads, partner access in Meta.
> - A tracking plan and a change log are part of the deliverable. No documentation means you're locked in, whether anyone intended it or not.
> - GTM versions are free audit trails. Insist on named versions with a description for every publish.
> - Write the exit into the contract on day one: what gets handed over, in what format, within how many days.

## Why ownership matters more than who you hire

I covered the hiring decision itself in [GTM consultant vs analytics agency](https://piotrlitwa.com/articles/en/gtm-consultant-vs-agency.html). This one is about what happens after you sign. Because the provider you pick matters less than the setup you agree to.

Here's the uncomfortable fact. Some Google assets can be moved between accounts. Some can't.

A GA4 property can be moved to a different Analytics account if someone has Administrator rights on both. A GTM container can't be moved to another account at all. If it lives in the agency's GTM account, there's one way out. Export it, import it into a new container, and put a new `GTM-XXXXXXX` snippet on every site.

That's not a theory. I see it two or three times a year.

## Monika's container that wasn't hers

Monika runs ecommerce for a cosmetics brand with three country stores. For four years, an agency handled ads and tracking.

Then the brand moved media buying in-house. The agency was polite, slow and technically correct.

Why correct? The GTM container and the GA4 property both sat in the agency's accounts. Monika had User access on the container and Viewer on the property.

The GA4 property was the easier part. After two weeks of emails, the agency moved it into an account Monika created, with its history intact. The container was the hard part. It held 214 tags, of which 61 were still doing anything useful, and there was no tracking plan, so nobody knew which 61.

The fix took most of a month. Export the container JSON, import it into a fresh container in Monika's account, clean it, then swap the snippet on three domains.

The cutover itself caused 9 days of messy data while the old and new containers overlapped on one store. Nobody did anything wrong in the legal sense. The contract just never said who owned what.

If Monika's first contract had one paragraph saying "all accounts are created by and owned by the client", none of that would have happened.

## What "your org" means, asset by asset

"Keep it in your org" is easy to say. Here's what it means in each tool:

- **Google Tag Manager.** You create the GTM account under a company Google account, not a personal Gmail. You're Administrator at account level. The provider gets a container-level permission.
- **Google Analytics 4.** You create the Analytics account and property. You're Administrator. Providers are added at property level, not account level, unless they need to manage several properties.
- **Google Ads.** The account is created by you, billing runs to your company's payment profile. An agency links its manager account (MCC) to yours. You can unlink it whenever you want, because you hold Admin.
- **BigQuery.** The Google Cloud project and its billing account are yours. For the GA4 export, the person creating the link needs Editor on the GA4 property and Owner on the Cloud project, so do that step yourself or grant Owner temporarily.
- **Meta.** Your business portfolio owns the ad account, the Page and the dataset (the pixel). The agency gets access as a partner, assigned to specific assets.
- **Everything around it.** Server-side GTM runs in your Cloud project on a subdomain you control. Your CMP account is in your company's name. API keys and service accounts sit in your secret store, not in the agency's password manager.

A test I use: if the agency vanished tomorrow, could you log into every one of these without asking anyone? If the answer is no for even one, start there.

## Access levels: give the minimum that works

Both GTM and GA4 have fine-grained permissions. Almost nobody uses them. Shame.

The default I see is "make everyone admin so nobody has to ask". It works fine. Until an intern publishes on a Friday afternoon.

In GTM, container permissions come in four levels:

| GTM permission | What it allows | Who should have it |
|---|---|---|
| Read | View the container, versions and settings | Auditors, monitoring, new providers in week one |
| Edit | Create workspaces and change tags, triggers, variables | Your implementation provider |
| Approve | Edit, plus create versions and approve changes | A senior person on the provider's side |
| Publish | Everything above, plus push changes live | One or two named people, ideally one of them yours |

On top of that, account-level access is either User or Administrator. Administrator can add and remove users. Keep that on your side only.

In GA4, the roles are Administrator, Editor, Marketer, Analyst and Viewer. A tracking provider usually needs Editor, to manage events, custom dimensions and data streams.

A media agency usually needs Marketer, to build audiences and key events. Someone who only reads reports gets Viewer. There are also data restrictions, "No Cost Metrics" and "No Revenue Metrics", if you don't want a provider seeing margins.

In Google Ads, give agencies Standard access, not Admin. Standard can run campaigns. It can't add or remove users or change who owns the account.

## The control checklist

This is the table I'd keep in the contract annex. It's short enough to check in an hour.

| Asset | Owner (admin) | Provider access | How to check |
|---|---|---|---|
| GTM account | You (company Google account) | None at account level | Admin, User Management, account level |
| GTM container | You | Edit, or Publish for 1-2 named people | Admin, User Management, container level |
| GA4 account and property | You | Editor or Marketer at property level | Admin, Account access management |
| Google Ads | You, billing in your name | Standard via manager account link | Admin, Access and security |
| BigQuery project | You, your billing account | Data Viewer plus Job User, or Data Editor | Google Cloud console, IAM |
| Meta business portfolio | You | Partner, assigned to specific assets | Business settings, Partners |
| Server-side GTM | Your Cloud project and subdomain | IAM role on the project | Cloud Run service and DNS records |
| CMP account | You | Shared user, not owner | CMP admin panel |
| Tracking plan and change log | You (your drive) | Edit | File owner in your shared drive |

If a row says "agency" in the owner column, that's your first fix. The same checks belong in any [GTM audit](https://piotrlitwa.com/articles/en/gtm-audit.html), under governance.

## Documentation and versioning: the part that prevents lock-in

Lock-in rarely comes from bad intentions. It comes from knowledge in one person's head. Nowhere else. A provider who leaves no documentation has locked you in, even if they'd happily hand over every password.

Three documents keep you independent:

1. **A tracking plan.** One row per event: name (`generate_lead`, `purchase`), when it fires, parameters and their meaning, which tools receive it, who owns it. A spreadsheet is fine. It just has to exist, in your drive.

2. **A change log.** Date, what changed, why, who approved. It can be the GTM version history if versions are named properly. "Version 147" with no notes is useless. "Added `form_type` to `generate_lead`, ticket MKT-212" is an audit trail.

3. **An access register.** Who has what level in which tool, and when it was last reviewed. Review it every quarter. Nearly every time I check one, I find at least one person who left the provider a year earlier and still has Publish.

Insist on named GTM versions with a description for every publish. It costs the provider 30 seconds each. Tag Manager 360 adds formal approval workflows. On the free version you get the same effect by limiting Publish to two people and requiring a ticket number in the version notes.

Missing documentation is a form of debt, and it compounds the same way the rest of [marketing technical debt](https://piotrlitwa.com/articles/en/marketing-technical-debt.html) does. You pay for it the day you try to change providers.

## Rafał's one-afternoon offboarding

Now the opposite case. Rafał is the marketing director at a manufacturing company near Wrocław. When he hired an agency in 2023, he set up every account himself first, then invited them in: Edit on the GTM container, Publish for one named person, Editor on GA4, Standard on Google Ads through their manager account, and partner access in Meta for two assets.

The agency was also contractually required to keep the tracking plan in a shared drive Rafał owned and to name every GTM version.

In 2026 he switched providers. Offboarding took one afternoon. He removed 4 users from GTM and GA4, unlinked the manager account in Google Ads, removed the partner in Meta Business settings, and rotated 2 API keys. The new provider got Read access on day one, read the tracking plan, and was making changes in week two.

Zero data gaps. No negotiation. The difference between Rafał and Monika was a paragraph in a contract and an hour of setup.

## Red flags when you outsource analytics

I'll be blunt: if a provider insists on creating the accounts "to save you time", I'd walk away. There's no technical reason for it. Here's what else to watch for:

- **Agency-owned containers or properties.** The account name in GTM or GA4 is the agency's name, not yours.
- **Shared logins.** One `analytics@agency.com` Google account used by five people. You can't revoke one person, and you can't see who did what.
- **Ad billing on the agency's card.** Convenient, until the account is technically theirs.
- **Tracking scripts on their domain.** A "proprietary" tag loaded from the agency's CDN or a server container on their subdomain. When the contract ends, that script stops working.
- **No exports, ever.** Reports only inside their dashboard, raw data never in your BigQuery.
- **"Documentation comes later."** Later doesn't arrive.

None of these are proof of bad faith. They're all proof that leaving will cost you.

## The exit clause and handover checklist

Put this in the contract before work starts. When I work with a client, I propose it myself, because it's the clearest sign you won't need it.

- Handover within 10 working days of notice.
- Full GTM container export (JSON) and the current version number, plus confirmation that no tags load from provider-controlled domains.
- The tracking plan, change log and access register, up to date, in a format you can open without their tools.
- All custom reports, Looker Studio dashboards and BigQuery queries transferred to your ownership.
- Removal of all provider users across GTM, GA4, Google Ads, Meta and Google Cloud, with written confirmation.
- A list of every API key, service account and webhook they created, so you can rotate or delete them.
- One handover session or document covering open issues and anything half-finished.

A provider who objects to this list is telling you something. A good one has nothing to hide in it.

## Frequently asked questions

**Is it safe to outsource analytics?**
Yes, if the accounts stay in your organization and the provider works with limited access. The risk isn't outsourcing itself. It's letting the provider own the GTM container, the GA4 property or the ad accounts, which makes leaving slow and expensive.

**Can I move a GTM container from an agency's account to mine?**
Not directly. GTM doesn't support moving containers between accounts. You export the container as JSON, import it into a new container in your own account, and replace the snippet on your site with the new container ID.

**Can a GA4 property be transferred to my account?**
Yes. GA4 lets you move a property between Analytics accounts, as long as the person doing it has Administrator rights on both the source and the destination account. Historical data comes along with the property.

**What access should an analytics agency have in GTM?**
Edit for the people building tags, and Publish for one or two named people. Account-level Administrator should stay with you. Start new providers on Read until they've reviewed the container and the tracking plan.

**What should a handover from an analytics provider include?**
A container export, the tracking plan, a change log, an access register, transfer of all reports and queries, removal of every provider user, and a list of API keys and service accounts to rotate. Agree on a deadline, such as 10 working days, before work begins.

**Should I hire one provider for ads and tracking?**
You can, but then nobody independent checks the conversion numbers the ads are judged on. If you do, add separate monitoring or a periodic audit from someone who doesn't run your campaigns.

## Next steps

Do the ownership check this week. Open GTM, GA4, Google Ads, Meta Business settings and the Google Cloud console, and write down who is administrator in each. It takes an hour.

Then compare it with the control checklist above. If you're working with a [GA4 consultant](https://piotrlitwa.com/articles/en/ga4-consultant.html) or an agency now, send them the table and ask them to fill in their column.

The second step is making sure someone outside the delivery team keeps an eye on the data. That can be your own analyst, a [GTM monitoring service](https://piotrlitwa.com/articles/en/gtm-monitoring-service.html), or an [independent agency oversight](https://piotrlitwa.com/services.html#agency) check. And if you want a quick look at what's running in your container before any of that, the [free GTM audit](https://piotrlitwa.com/checkGTM/) takes a few minutes.

---

**Sources and further reading**
- [Tag Manager user permissions](https://support.google.com/tagmanager/answer/6107011) (Google)
- [GA4 access roles and data restrictions](https://support.google.com/analytics/answer/9305587) (Google)
- [Set up BigQuery Export for GA4](https://support.google.com/analytics/answer/9823238) (Google)

---

*Written by [Piotr Litwa](https://piotrlitwa.com/about.html) - independent GTM & Analytics specialist.*