How to Add a User to Google Search Console & GA4 (2026)

How Do You Add a User to Google Search Console and Google Analytics 4?

To add a user to Google Search Console, navigate to Settings > Users and permissions > Add user, then enter their email address and select Full or Restricted access. For Google Analytics 4, go to Admin > Account Access Management > Add users, and assign an appropriate role (Administrator, Editor, Marketer, Analyst, or Viewer). Both platforms require the user to have a Google account—this allows your SEO agency to access your data without sharing login credentials.

Granting proper analytics access is essential when working with marketing agencies or expanding your internal team. Google Analytics commands 78.8% market share among analytics tools, whilst 80% of UK businesses use it to track website performance. Yet many business owners struggle with the technical process of adding users securely.

This guide walks you through the current 2026 process for both Google Search Console (GSC) and Google Analytics 4 (GA4), including which permission levels to grant, security best practices, and UK GDPR considerations. Whether you're onboarding a new HubSpot partner or giving your marketing manager reporting access, you'll find everything you need below.

Adding Users to Google Search Console: Step-by-Step Process

Google Search Console uses a property-based permission system with a maximum of 100 non-owner users per property. The process takes approximately two minutes and requires you to have Owner-level access yourself.

Follow these steps to grant GSC access:

1. Sign in to Google Search Console at search.google.com/search-console
2. Select the correct property from the dropdown menu in the top-left corner (choose between Domain or URL-prefix property)
3. Click Settings in the left-hand navigation panel
4. Select Users and permissions under the Users and Property Owners section
5. Click the Add user button in the top-right corner
6. Enter the user's email address (must be associated with a Google account)
7. Choose the permission level: Full or Restricted
8. Click Add to confirm

The new user will receive an email notification and can immediately access your Search Console data. For a deeper understanding of how to interpret that data, see our complete guide to Google Search Console.

Google Search Console Permission Levels Explained

GSC offers four permission levels, each providing different capabilities. Choosing the right level follows the principle of least privilege—grant only the access needed to perform the required tasks.

Whitehat SEO recommends granting Full User access to your SEO agency. This allows them to submit sitemaps, request indexing for updated pages, and use the disavow tool if necessary—all critical functions for effective SEO management. Reserve Owner access for internal stakeholders only.

Adding Users to Google Analytics 4: Complete Walkthrough

Google Analytics 4 replaced Universal Analytics in July 2023, introducing a new permission structure. GA4 uses a hierarchical system where account-level permissions automatically cascade to all properties beneath them—a critical consideration when granting agency access.

To add a user in GA4:

1. Sign in to Google Analytics at analytics.google.com
2. Click the Admin cog in the bottom-left corner
3. Choose your access level: Account Access Management (all properties) or Property Access Management (single property)
4. Click the blue + button and select Add users
5. Enter the user's email address
6. Select the appropriate role (see table below)
7. Optionally apply data restrictions (No Cost Metrics or No Revenue Metrics)
8. Click Add to confirm

The user receives an email notification with access instructions. Understanding these permissions properly helps ensure you maintain accurate marketing attribution whilst protecting sensitive business data.

GA4 Roles and Permission Levels

GA4 offers five distinct roles, plus two data restrictions. According to Google's official documentation, you should "grant users only the permission level that they need to do their work"—this minimises security risks and accidental data changes.

For most agency relationships, Marketer or Analyst access at the property level provides the right balance. This allows your agency to create the custom reports and audiences needed to optimise campaigns without exposing sensitive account-wide settings. At Whitehat SEO, we typically request Analyst access to deliver comprehensive website audit reporting.

Security Best Practices for Analytics Access

Security should never be an afterthought when sharing analytics access. Microsoft research shows that 99.9% of compromised accounts don't have multi-factor authentication (MFA) enabled—yet 43% of security investigations find MFA wasn't configured.

Essential security measures:

• Require two-factor authentication for all users with analytics access—Google now enforces 2-Step Verification for administrator accounts
• Use work email addresses rather than personal Gmail accounts for clearer audit trails and easier offboarding
• Grant property-level access in GA4 rather than account-level to prevent cascade effects
• Apply data restrictions (No Cost Metrics, No Revenue Metrics) when agencies don't need financial data
• Conduct quarterly access audits to remove former employees and expired agency relationships
• Never share login credentials—always add users through the proper interface

Analytics consultant Paul Koks advises: "You should only give access at this level to trusted people. Usually I don't recommend giving anyone outside of the company Owner access. Why should an agency be able to add or remove people?" This principle applies equally to both GSC and GA4.

UK GDPR Compliance When Sharing Analytics Access

UK GDPR imposes specific requirements when sharing analytics data with third parties. Under this framework, you (the business) are the Data Controller, whilst your marketing agency acts as a Data Processor. Google functions as a Sub-processor.

Critical distinction: Google Search Console is inherently GDPR-compliant as it doesn't collect personal user data. According to GDPR Local, "explicit user consent is not required under data protection laws" for GSC. However, GA4 collects personal data including IP addresses, device identifiers, and user interactions—requiring proper consent mechanisms and processor agreements.

Before granting GA4 access to an agency, ensure you have:

• A Data Processing Agreement (DPA) executed before sharing any personal data—Article 28 mandates this
• Due diligence documentation on your agency's security measures
• Updated privacy policy disclosing third-party processing
• Breach notification procedures (72-hour requirement)
• Clear data retention terms in your agreement

Reputable agencies will already have a standard DPA ready for you to sign. If your agency doesn't mention GDPR compliance during onboarding, consider it a red flag. Proper attribution reporting requires both legal compliance and technical accuracy.

Five Common Mistakes When Granting Analytics Access

Even experienced marketers make these errors when managing analytics access. Avoiding them protects both your data and your agency relationships.

1. Giving Admin when Viewer would suffice—Users with Edit/Admin access can accidentally delete properties or alter data collection settings
2. Forgetting to remove access when relationships end—Former agencies often retain access indefinitely, creating security and data exposure risks
3. Sharing login credentials instead of adding users properly—This creates no audit trail and violates Google's Terms of Service
4. Using personal Gmail accounts—Complicates offboarding and bypasses organisation security policies
5. Forgetting inherited permissions in GA4—Account-level access automatically applies to ALL properties beneath it

Rand Fishkin, co-founder of Moz and CEO of SparkToro, emphasises transparency in agency relationships: "An agency's willingness to discuss failures reveals far more about their expertise and honesty than a parade of successes." The same applies to data access—a trustworthy agency will request only what they need and explain why.

How to Revoke Analytics Access When Changing Agencies

Removing user access is straightforward in both platforms, but GSC requires extra attention if you've granted Owner access through verification tokens.

For GSC: Navigate to Settings > Users and permissions, click the three-dot menu next to the user, and select Remove access. Critical: If you granted verified Owner access, you must also delete all verification tokens (HTML file, DNS record, or meta tag) or the former user can re-verify themselves.

For GA4: Go to Admin > Account/Property Access Management, find the user, click the three-dot menu, and select Remove. Changes take effect immediately.

Check GSC's "Unused ownership tokens" report regularly—it highlights verification methods that may have been forgotten, representing potential security gaps.

Why Your Agency Needs Both GSC and GA4 Access

Google Search Console and Google Analytics 4 serve complementary purposes. Your agency needs both to deliver effective results.

GSC answers: "How do users find your site?" It provides search performance data, indexing status, technical SEO insights, and Core Web Vitals metrics. This helps identify high-impression, low-click pages ripe for optimisation.

GA4 answers: "What do users do once they arrive?" It tracks user behaviour, conversions, traffic sources, and audience demographics. This confirms whether SEO improvements translate into business outcomes.

Together, these tools enable proper attribution reporting—connecting search visibility to actual revenue. Without both, your agency is working with incomplete data.

Frequently Asked Questions

Next Steps: Get Expert Help With Your Analytics Setup

Properly configured analytics access is the foundation of effective digital marketing. With 33% of UK businesses using agencies for SEO, getting this right from the start saves time and protects your data.

If you're looking to maximise your marketing ROI with proper attribution and reporting, contact Whitehat SEO for a free consultation. As a HubSpot Diamond Solutions Partner, we help UK B2B companies connect their analytics to real business outcomes.

References and Further Reading

1. Google. (2025). Access and data-restriction management - Analytics Help. support.google.com/analytics/answer/9305587
2. MeasureU. (2025). GA4 User Roles and Permissions - Everything You Need to Know. measureu.com/google-analytics-permissions
3. Online Metrics. (2025). Best Ways to Deal With Google Analytics User Permissions. online-metrics.com/user-permissions
4. Leadsie. (2025). How to Give Access to Google Search Console: Step-by-Step Guide. leadsie.com/blog/give-and-request-access-google-search-console
5. Harper James. (2025). What is a Data Processing Agreement and when do you need one?. harperjames.co.uk/article/controller-to-processor-agreement
6. HubSpot. (2025). Integrate Google Analytics with HubSpot content. knowledge.hubspot.com