Digital Marketing Tip #472: Don’t provide all vendors write/edit access to your Google Analytics or Tag Manager accounts. Though they ask for it, they may not need it.
I enjoy working with vendors. Over the last 15 years, I’ve had the opportunity to work with many different vendors as well as being the vendor myself. Having vendors can help augment or supplement the staff or tools available. A common request when working with digital marketing vendors is for them to have full read/write access to a Google Analytics or Google Tag Manager account. A lot of times, this is necessary–i.e. a vendor is running Google AdWords campaigns and wants to tie metrics into conversion goals. Sometimes, though, it is a generic request at the start of a project. This is similar to a common development agency request of root access to your server. Most of them don’t actually need it, so why would you provide total access to your server? Many times the request is made just because it makes other work provided easier–not smarter.
Recently, as I have ramped up at a new job, I have been digging into the Google Analytics (GA) and Google Tag Manager (GTM) accounts to find that it is a big, convoluted mess without consistent naming convention or structure. To make matters worse, it is very clear that some of the tags and events are causing issues with data validity. It has taken me weeks to figure out the setup and–of course–since some of the agencies no longer provide services to the company, there is no one available to help decipher some of the code. I’m about three WTFs away from wiping out everything and starting over with a clean slate.
How do you keep this from happening to you? Here are a few ways to help keep your accounts clear and straight.
- Have a staff member oversee access to your analytics – working with agencies is sometimes the best way to bring on knowledgeable staff without the HR overhead. That said, they can come and go. As a company, YOU should always own your own data and accounts. Have someone internal be the end-of-the-road when it comes to your GA and GTM accounts. They don’t have to understand everything about the platforms. They just need to be a stickler for details and not intimidated by agencies.
- Always ask “why?” when the request is made – any vendor worth the effort will have a valid, specific business case for why they need access. If they only need to see the analytics, then read-only access it is. If they need to implement tracking codes, that is something your staff member could do or you could open up temporary access. Are they even scoped for the kind of access they are requesting? In the end, the request should be followed by a logical reason outside of “we just need it to do <insert task>.”
- Keep the big picture in mind – depending on your situation, there could be more than one department or area that use the GA or GTM accounts. Changes made to both need to think about how they could affect the data for other groups or metrics. For example, some GA event tags can cause session counts to artificially inflate. This could cause errors in reporting for another team if they were relying on the session metric.
- Audit access regularly – just because someone needed access yesterday–even just read access–doesn’t mean that they will need access today or tomorrow. I typically make it part of my quarterly password rotation process to also check what users have access to GA and GTM and remove those who no longer need access.
Following the steps above is a great place to start to help ensure you don’t end up with the same problem that I have right now. Remember, because they ask for it doesn’t mean that they actually need it.
