Most practices find out who owns their Google accounts on the worst possible day: the day they part ways with a marketing vendor. A new agency asks for Search Console access, someone opens the user list, and the only owner is an email address nobody in the building recognizes. The Business Profile is in a similar state. Nothing is broken yet, but nobody on the practice side can add a user, remove one, or prove the site belongs to them.
This post explains how ownership works in Google Search Console and Google Business Profile, the specific ways businesses lose control of both, and a short audit you can run this week. It is written for behavioral health and treatment providers, but the mechanics are the same for a B2B manufacturer or a law firm.
The short version
In Google Business Profile, a newly added owner or manager has to wait 7 days before they can remove other owners or managers, transfer primary ownership, or delete the profile. If you request ownership of a profile someone else controls, the current owner is emailed and has 3 days to respond before you may be offered the option to claim it, and that option is not always available. In Google Search Console, a property must keep at least one verified owner, and if every verified owner loses verification, every user loses access. Taken together, an agency handoff that starts on the last day of a contract is already late. The practice should hold owner-level access to both accounts before any vendor is added, not after one leaves.
Those figures come from Google’s own help documentation on managing Business Profile owners and managers and requesting ownership of a Business Profile, checked on 1 October 2026.
How Search Console ownership actually works
Search Console has four permission levels, including associates for linked services, described in Google’s help article on managing owners, users, and permissions. Owners have full control: they add and remove users, change settings, and use every tool. Full users can see all data and take some actions. Restricted users can see most data.
The detail that matters most is that there are two kinds of owner. A verified owner proved control of the site with a token: an HTML file on the server, a meta tag in the homepage, a Google Analytics or Tag Manager snippet, or a DNS record. A delegated owner was simply added by another owner from the user management screen. Both have the same permissions on the day they are granted, but only one of them keeps the property alive.
According to Google’s documentation on verifying site ownership, verification lasts only as long as Search Console can still find the token. Google checks periodically. If the token disappears, the owner is notified and, after a grace period, the permission expires. If that was the last verified owner, every delegated owner and every user goes with it. A delegated owner is only as secure as the verified owner above them.
One piece of good news from the same page: data is collected for a property as soon as anyone adds it, even before verification. Losing access does not delete your search history. Regaining access by verifying again brings the reports back.
How Google Business Profile ownership works
A Business Profile can have several owners but only one primary owner. Owners can add and remove people, edit the profile, and delete it. Managers can do almost everything an owner can, including editing business information, replying to reviews and publishing posts, but they cannot add or remove users or remove the profile. The primary owner cannot remove themselves until they transfer primary ownership to another existing owner or manager.
Healthcare providers have a second reason to care who holds manager access: anyone with it can reply to reviews in the practice’s name. A reply that confirms a reviewer was a patient can itself disclose protected health information under HIPAA. The people who can post as your practice should be people you have trained and can remove.
Four ways businesses lose access without noticing
- The verified owner left: the only verified Search Console owner was a former staff member or a vendor’s employee, and everyone else is a delegated owner hanging off that one account.
- A redesign removed the token: verification relied on a meta tag in the old homepage template or an HTML file on the old server, and the new build did not carry it over, so Search Console quietly starts its grace period.
- The tracking snippet changed: verification depended on a Google Analytics or Tag Manager snippet, and a new developer replaced the container or removed the code, which breaks the verification along with the tracking.
- The profile lives in someone else’s account: the Business Profile was created inside an agency’s account or a personal Gmail, so the practice appears as a manager or not at all.
What we see when we take over an account
When a new client hands us their accounts, we check ownership before any SEO work begins, because the same pattern keeps appearing. The Search Console property is usually a URL-prefix property rather than a Domain property, so it only covers one version of the site, such as https with www. The verification method is usually an HTML tag or an analytics snippet, which makes it fragile on any site that changes themes or tracking setups. Old owners are often still listed long after the relationship ended, because removing a verified owner means removing their token from the site, not just deleting a name from a list.
Google’s documentation is direct on that last point: to remove a verified owner, you remove their verification token, whether that is the HTML file, the meta tag, or the DNS record. Deleting them from the user list alone does not end their verification. On WordPress sites, that usually means looking in the theme header, an SEO plugin’s webmaster tools field, and the site root for a file named googleXXXX.html.
Our fix is the same every time. The practice verifies its own Google account through the domain name provider with a DNS TXT record. That is the only way to verify a Domain property, it covers every subdomain and both http and https, and it survives redesigns because it does not live on the website at all. Agencies, including ours, are then added as full users or delegated owners under it. When a website redesign happens, the verification does not move.
The 15-minute access audit you can run today
Do this from an account the practice controls, ideally a shared role-based Google account such as marketing@ on your own domain rather than any one person’s address.
- In Search Console, open Settings > Users and permissions. Write down every Owner and note whether Google lists them as a verified or delegated owner.
- Open Settings > Ownership verification and note which method each verified owner used. If every method is an HTML tag, HTML file, or analytics snippet, add a Domain property (example.com, with no https prefix) from the practice’s account and verify it with the DNS TXT record Search Console gives you, entered at your domain registrar.
- Remove anyone who should not be there. For verified owners who no longer work with you, remove their token from the site as well.
- In Google Business Profile, open More > Business Profile settings > People and access. Confirm the primary owner is an account the practice controls. If it is not, ask the current primary owner to add the practice as an owner and transfer primary ownership, and remember the 7-day waiting period before the new owner can make that change.
- Downgrade vendors from owner to manager on the profile, and from owner to full user in Search Console, unless they need ownership for a specific task.
If you find the practice is not an owner on either account, start now rather than at contract end. The 3-day response window and the 7-day waiting period only start counting once someone acts.
What to require from any agency, including us
The practice owns the accounts. The agency is a user. That should be written into the engagement, and it is the way our SEO engagements are set up. Concretely, ask any vendor to confirm in writing that the practice holds DNS-verified ownership of the Search Console Domain property, that the practice’s own account is primary owner of every Business Profile location, that no account is created in the agency’s name, and that offboarding means removing the agency’s users and tokens on a known date.
Once access is clean, the reports become useful again. If you are reviewing Search Console data for the first time in a while, our guide to reading the Performance report and average position explains what the numbers do and do not mean. Clean ownership is the difference between a vendor change that takes an afternoon and one that takes weeks.
