Most white label Google Ads partnerships don't fall apart over campaign performance. They fall apart over who's actually holding the account when the relationship ends. Here's the manager account structure that keeps ownership with the agency, no matter which fulfillment partner is doing the work behind the scenes.
Every white label Google Ads pitch sounds the same: certified specialists, faster turnaround, reporting under your logo. Almost none of those pitches mention who actually holds the Google Ads account once the campaigns are live. That single detail, buried under "onboarding," is what decides whether an agency can walk away from a bad fulfillment partner without losing the client in the process.
A white label Google Ads setup should run on three layers: the end client owns the Google Ads account, the reseller agency manages it through its own MCC (manager account), and the fulfillment partner reaches it through a further MCC link on top of that, with standard-not-admin permissions. When the fulfillment relationship ends, the reseller unlinks the partner's MCC and keeps the client, the data and the account, fully intact.
An MCC, short for Manager Account, is Google's container for handling multiple Ads accounts from a single login. Instead of logging into each client separately, an agency logs into one MCC and sees every linked account in one place, with one set of user permissions and one consolidated view of billing and reporting.
What makes MCCs relevant to white label fulfillment is that they can link to each other. A reseller's MCC links to its client accounts. A fulfillment partner's MCC then links to the reseller's MCC, not to the client directly. That second link is what creates a clean chain of access with an equally clean way to break it. A few properties of that chain matter more than they get credit for: any individual Ads account can sit under several MCCs at the same time; linking an MCC to an account grants access to it, not ownership of it; every link requires approval from whoever already owns the account, meaning it can't be forced through; and removing a link is fully reversible, it doesn't touch the account, its campaigns, or its history.
Layer one: the client's own Google Ads account. Every campaign, every conversion action, every dollar of ad spend and every year of historical performance data lives here, under the client's own Google account, not the agency's and not the fulfillment partner's.
Layer two: the reseller's MCC. This is the agency's own manager account, linked to every client account it manages. It's the layer that gives the reseller centralized reporting, centralized billing oversight, and full control over who else gets access.
Layer three: the fulfillment partner's MCC. A partner like DigitalRyze links its own manager account to the reseller's MCC, not to the client's account directly, and receives permission on the specific accounts it's been assigned to work.
Skipping the middle layer is tempting, since it looks like one less step during onboarding. Some agencies let the fulfillment partner link straight to client accounts and skip building their own MCC at all. It works, mechanically, but it hands the partner a level of structural control the reseller shouldn't be giving up: every access change, every new user, every billing question now runs through somebody else's manager account instead of the agency's own.
The partner builds the account inside its own MCC and never transfers it. Framed as "faster onboarding," this quietly puts the fulfillment partner in permanent control. If the relationship ends badly, the partner is the one deciding whether the account gets transferred, and there's very little the reseller can do about audience lists or conversion history built up over months or years.
The partner's card pays for the ad spend. Whoever's billing account is attached to Google Ads holds real leverage over whether campaigns keep running. If the fulfillment partner is fronting spend and waiting on reimbursement, a slow payment cycle or a cash flow problem on the partner's side can pause a client's campaigns for reasons that have nothing to do with performance.
The partner owns the tag manager container and conversion setup. Conversion tracking is the input every optimization decision depends on. If a fulfillment partner owns the GTM container and the conversion actions behind it, ending the relationship means rebuilding measurement from the ground up, and living with broken or missing data while a new partner catches up.
Google Ads gives agencies four permission tiers to hand out at the account or MCC-link level, and each one changes how much risk the reseller is carrying. Email-only access just forwards notifications and gives no real account control, which makes it too limited to be useful for a working partner. Read-only lets someone view campaigns and pull reports but not touch anything, which again falls short of what fulfillment actually requires. Standard access is the tier that covers real work: building and editing campaigns, adjusting keywords and bids, launching new ad groups. Admin access adds the ability to manage other users, edit billing, and create or remove MCC links entirely, control that belongs with the reseller, not with whoever is fulfilling the work.
DigitalRyze only ever asks for standard-level access on the accounts it fulfills, under a signed NDA and non-compete, with zero direct contact with the underlying client unless the reseller specifically asks for it. That's a deliberate boundary, not a limitation: a fulfillment partner doesn't need admin rights to do good work, and asking for them is itself a signal worth noticing.
Two billing setups hold up cleanly in a white label arrangement. Direct client billing has the end client's own card or bank account paying Google, with the reseller invoicing separately for management fees, the simplest model and the one that requires no working capital from the agency. Consolidated reseller billing has the reseller's card covering ad spend across the whole client book through its own MCC, then invoicing clients monthly for spend plus management fee, which takes more capital but lets the reseller offer net terms. What doesn't hold up is a fulfillment partner's card paying Google directly. That puts campaign continuity in someone else's hands and creates leverage a partner shouldn't have during a contract negotiation.
The same ownership logic applies to tracking. The GA4 property should be created under the client's own Google account, with the reseller and fulfillment partner both given editor access, never admin. The GTM container should sit under the client's or reseller's account, with the partner able to publish tags but not own the container outright. Conversion actions inside Google Ads live at the account level already, so they migrate cleanly whenever an MCC link changes, which is one more reason the account itself has to stay with the client. If a partner runs server-side tracking through something like Stape or a custom setup, the reseller should have full credentials and an exportable configuration on file, not a dependency on the partner's infrastructure.
A clean MCC structure isn't paperwork. It's the difference between a partnership that ends with a handshake and one that ends with an agency negotiating for its own client's data.
The account hierarchy sets up the technical reality, but contract language is what makes it enforceable when a relationship goes sideways. An account ownership clause should state plainly that the Google Ads account, GA4 property, GTM container and conversion setup belong to the client or reseller at all times, with the fulfillment partner holding access rights only. An exit clause with a handover window, commonly 90 days, should require the outgoing partner to document campaign structure, tracking setup, audience configuration and bidding history before access is cut off. A non-solicitation clause should stop the fulfillment partner from directly pitching or contracting with the reseller's end clients for a set period after the relationship ends, often two to three years. And a data portability clause should guarantee that campaign data, keyword research, audience lists and performance history are exportable in a usable format, not handed over as static PDFs nobody can act on.
Plenty of agencies inherit a messy setup from an earlier fulfillment relationship: a Google Ads account still living on a former partner's MCC, a GTM container tied to a freelancer who's long gone, a GA4 property nobody currently has admin rights to. Untangling it follows a fairly consistent order: document every Google asset in play and who currently controls each one, stand up a proper reseller MCC if one doesn't already exist, request account-level ownership and access changes through Google Ads (each of which needs cooperation from whoever currently holds admin rights), migrate GA4 and GTM ownership over to the client's own Google account, and then write down the new structure in a simple one-page map that gets updated at least once a year. Depending on how cooperative the outgoing partner is, this typically takes somewhere between 30 and 60 days per client. The alternative, staying on the broken structure indefinitely, just extends a dependency the agency never chose to be in.
An MCC, or Manager Account, is a Google Ads container that lets one login manage many individual client accounts from a single dashboard. MCCs can also link to other MCCs, which is what makes a three-layer white label structure possible in the first place.
The end client, always. The reseller manages that account through its own MCC, and a fulfillment partner is granted access through a further MCC link. Neither the reseller nor the partner should hold the account itself, since ownership is what determines who keeps the data when the relationship ends.
Yes. A single account can sit under several manager accounts simultaneously, and each link requires the account owner's approval. That's the mechanism a reseller's MCC and a fulfillment partner's MCC both rely on to reach the same client account without either one taking it over.
Standard access, not admin. Standard covers everything needed to build and optimize campaigns. Admin adds the ability to manage users and billing and to create or remove MCC links, which is control a reseller should keep for itself.
Nothing is lost. Unlinking only removes an access path between accounts; it does not delete the account, its campaigns, its conversion history, or its audiences. That reversibility is exactly why the reseller's own MCC should sit between the client and any fulfillment partner.
Four things at minimum: an explicit account-ownership clause naming the client or reseller as owner, an exit clause with a defined handover window, a non-solicitation clause covering the reseller's client book, and a data-portability clause covering campaign history, audiences and reporting.
Book a 30-minute partnership call. We'll look at one of your current client Google Ads structures, flag any lockout risks we find, and walk through a migration path if you need one, free of charge.
The call is with me, not a salesperson.
MCC hierarchy, permissions and billing, together.
What to fix first, and what it costs.