How to Give a Tracking Specialist Access: GTM, GA4, Google Ads, Meta Business, Search Console, Shopify and WordPress

Half of every tracking project is waiting for access. This guide tells you exactly where to click, which role to pick, and what to avoid, for each platform a tracking specialist typically needs. The business keeps ownership of everything; the specialist gets the role required to do the work.

Google Tag Manager

Access is at two levels. Account access controls who can see the account; container access controls what they can do in the container.

1. Open tagmanager.google.com, choose the account, then Admin.
2. Under Account, click User management, then the plus button, then Add users.
3. Enter the specialist's Google email. Account permission: User. Container permission for the relevant container: Publish.
4. Send the invitation. They accept by email.

Roles: Read can look; Edit can change in a workspace; Approve can create versions; Publish can push live. A specialist implementing tracking needs Publish. Administrator at account level is only for managing users and is not required.

For server-side containers, grant the same on the server container.

Google Analytics 4

1. Open analytics.google.com, then Admin.
2. Under Property, click Property access management, then the plus button, then Add users.
3. Enter the email. Role: Editor. Leave the data restriction boxes unticked.

Roles: Viewer reads reports; Analyst can create Explorations and shared assets; Marketer adds audiences and key events; Editor changes settings, events and links; Administrator manages users. Editor is right for implementation and settings. Grant at property level, not account level, unless they need every property.

Google Ads

1. Open ads.google.com, then Admin in the left menu, then Access and security.
2. Click the plus button, enter the email, choose access level Standard, and send the invitation.

Levels: Email only, Billing, Read only, Standard, Admin. Standard allows conversion actions, linking and campaign changes without user management or billing. If the specialist manages several clients they may ask to link your account to their manager account instead; approve the link request under the same screen, which keeps your account in your ownership.

Meta Business Portfolio

Meta works best with partner access, where the specialist's own Business Portfolio is granted permissions on your assets.

1. Open business.facebook.com, then Settings, then Users, then Partners.
2. Click Add, then Give a partner access to your assets. Enter the partner's Business ID, which they will send you.
3. Select assets and permissions: Ad account with Manage campaigns, Dataset or Pixel with Manage, Page with Content and Ads permissions, Catalog with Manage if ecommerce.
4. Save.

If they do not have a Business Portfolio, add them under People with an email, assign the same assets, and choose task-level permissions rather than full control. Do not add anyone as Business admin unless they need to manage users and billing.

Also confirm the dataset is connected to the ad account under Data sources, so events can be used for optimisation.

Google Search Console

1. Open search.google.com/search-console, choose the property, then Settings, then Users and permissions.
2. Add user with Full permission. Owner is not needed and should remain the business.

Shopify

1. From the Shopify admin, Settings, then Users and permissions.
2. Either send a collaborator request code to the specialist, who requests access through their Partner account, or add staff with limited permissions.
3. Permissions needed: Online Store themes to edit theme.liquid, Settings for Customer events and Notifications for webhooks, Orders for testing, Apps and channels if a channel pixel must be disconnected.

Collaborator access does not count toward the staff limit and is easier to revoke.

WordPress and WooCommerce

1. Users, then Add New. Role: Administrator is required to install a GTM plugin and edit theme code; Editor cannot. If you prefer not to grant Administrator, install the GTM container yourself using the specialist's container ID, then grant Shop Manager for WooCommerce testing.
2. Provide access to the hosting file manager or SFTP only if a child theme snippet must be added and no code snippets plugin is acceptable.

Other Platforms

• Wix, Squarespace, Webflow: add the specialist as a site collaborator with design or developer permissions, which is enough to paste the GTM code.
• GoHighLevel: add as an agency team member with access to the sub-account's sites and funnels.
• HubSpot: User with Marketing and Website tools permissions, and Settings access for tracking code.
• Stripe or payment providers: Developer role for webhook configuration, never Administrator.
• Server-side GTM host such as Stape: add a team member in the host's dashboard with container-level access.
• Google Cloud for self-hosted sGTM: IAM role Cloud Run Admin on the project, not Owner.

What You Should Never Share

• Passwords or two-factor codes.
• Ownership of any account.
• Billing or payment method access.
• Admin on Meta Business or Google Ads when Standard or partner task access is enough.

Offboarding Checklist

• GTM: remove the user. Check that no personal Google account of theirs is the only Administrator.
• GA4: remove at property level.
• Google Ads: remove the user or unlink the manager account.
• Meta: remove the partner or person.
• Shopify, WordPress, hosting: remove the collaborator or user and rotate any API keys they created.
• Server-side host and cloud: remove the team member.

Done this way, a new specialist can start the same day, and you can end the engagement without changing a single password.