GBP Owners, Managers and Who Should Have Access

A profile with one Primary Owner who left the company two years ago, no admin backup, and a marketing agency that quietly lost access when a contract ended, is one of the most common states we find a Google Business Profile in during an initial audit. Nobody removed anyone deliberately. Access just eroded, one departure at a time, until nobody currently at the business could actually make a change if they needed to.

The three access levels and what each one can actually do

Google gives a GBP three roles. Primary Owner, one per listing, the only role that can remove other owners, delete the listing, or transfer primary ownership itself. Owner, can do nearly everything a Primary Owner can except those three actions. Manager, can edit most fields, respond to reviews, publish posts and photos, but cannot add or remove other users and has more restricted access to certain settings depending on the feature.

The distinction that trips people up most is between Owner and Manager. An agency handling day-to-day GBP management rarely needs full Owner access, and giving it anyway is usually a mistake, since it hands over the ability to remove the actual business owner from their own listing. Manager access covers the vast majority of what an agency or an in-house marketing team actually does: posting, review replies, photo uploads, and edits to hours, description, and attributes. This kind of edit access is exactly what write-back to Google depends on functioning correctly for every listing in scope.

What happens when the Primary Owner leaves the company

This is the scenario that causes the most damage, because it's invisible until someone needs to make a change and can't. If the departing Primary Owner is reachable, transferring ownership before they leave, through the Business Profile settings under Business ownership transfer, is the clean path. If they're unreachable, or the business never confirmed who actually holds Primary Owner before the person left, Google's recovery process requires proving the requester's connection to the real business, which can take days to weeks depending on the verification evidence available, a delay covered in more detail in handling GBP suspensions and appeals since the recovery process shares some of the same evidentiary friction.

The lesson this points to is preventive, not reactive: every GBP should have at least two people, ideally not both dependent on the same employment relationship, holding Owner-level access at any given time. A single point of failure on account access is a bigger operational risk than most businesses treat it as, and it shows up specifically when GBP verification or a recovery flow is needed under time pressure, or when GBP verification problems in India are already slowing things down for unrelated reasons.

Managing access across a multi-location or franchise portfolio

A chain with thirty locations doesn't want thirty separate access lists maintained by hand, each with its own drift and its own forgotten former employee still sitting as a Manager. Google's Business Profile groups, called locations groups, let a Primary Owner grant access at the group level rather than location by location, which is the baseline fix. Managing multiple locations at real scale, the kind covered for franchise GBP management specifically and for chains managing a hundred or more listings, usually layers a role structure on top of the Google-native one, distinguishing an Agency Admin who sees the whole portfolio from a Project Manager who sees an assigned subset from field staff who only need Manager-level access to their own location.

This is the structure Angryturtle's Agency OS is built around: Agency Admin, SEO, Project Manager, and Client roles inside the platform itself, sitting on top of whatever native Google access each account holds, with an audit trail of who changed what and when, exposed through the same 22-endpoint API an agency can build its own tooling against. That layer matters more as a portfolio grows, since native Google access management has no built-in reporting on who's touched a listing recently or whether an ex-employee's Manager access ever actually got revoked.

Auditing who currently has access

Go into Business Profile settings, then Users, and read through the full list rather than assuming it matches whoever's currently on staff. Cross-reference it against current employment and current agency contracts specifically, since this is exactly the list that drifts silently when someone leaves without an offboarding checklist that includes GBP access. This is worth doing at the same cadence as a broader GBP optimisation checklist review and alongside onboarding new business locations, since access hygiene rarely gets checked on its own initiative otherwise.

Frequently asked questions

Can a listing have more than one Primary Owner? No. There's exactly one Primary Owner per listing at any time, though ownership can be transferred to a different person, which changes who holds that single role rather than adding a second one.

What happens if the only person with access leaves and can't be reached? Google has a recovery process for this, but it requires evidence connecting the requester to the actual business, business documents, domain ownership, or other verification signals, and it can take meaningfully longer than a routine access change, which is exactly why maintaining at least two active Owners in advance is worth the small extra setup effort.

Should an SEO agency ever request Primary Owner access? Generally no. Manager or Owner access covers the operational work an agency does. Primary Owner grants control that should stay with the business itself, including the ability to remove the business's own staff from the listing.

Does adding more managers to a profile create a security risk? Only if access isn't reviewed periodically. Each additional Manager is a smaller individual risk than a single point of failure on access, but an unreviewed list that accumulates former employees and lapsed agency contracts over years becomes its own liability.