Google Ads Multi-Party Approval Is Live July 27: What Ecommerce Brands

Cashmas in July — Turn unsold inventory into cash before Q4. Cashmas in July — Turn inventory into cash. Learn More →

On July 24, 2026, Google began rolling out Multi-Party Approval for Google Ads accounts, requiring a second administrator to confirm any sensitive access changes starting July 27. For ecommerce brands managing ads through agencies, this means that adding or removing an agency contact, or changing who has admin access to your account, now requires sign-off from a second admin before it takes effect.

This is part of a broader security push Google has been making throughout 2026. You can follow along with our full Google Ads 2026 update tracker as these changes continue to roll out.

What Does Multi-Party Approval Mean for Your Campaigns?

Multi-Party Approval (MPA) is a new security layer that requires a second administrator to confirm sensitive account actions before they go into effect. It applies only to Google Ads accounts with more than three administrators. If your account has three or fewer admins, this change does not apply yet, but Google may expand the threshold over time. If an account drops to a single admin, MPA is automatically paused.

Which Actions Now Require a Second Approval?

When Multi-Party Approval is active, the following actions will trigger a pending approval request that a second admin must confirm:

Adding a new user to the account
Removing an existing user from the account
Changing a user's access level (for example, upgrading someone from standard to admin)

Approval requests expire after 20 days if no action is taken. Read-only roles and API users are exempt from the approval requirement, so automated integrations and reporting tools are not affected by this change.

Approval requests expire after 20 days. If no second admin acts on the request, the change never goes through, and no email notification is sent to remind anyone.

One critical detail: Google does not send email notifications when an approval request is created. Admins must check in-product notifications manually inside the Google Ads interface. This creates a real operational risk if your team is not actively monitoring the notification center.

How Does This Affect Brands Working With Agencies?

The most significant friction point for brands working with outside agencies is that revoking agency access now requires a second admin to approve the action. If a brand decides to end an agency relationship or pause an agency's access while a review is underway, that change cannot happen instantly, and it will not take effect until a second admin confirms it inside Google Ads.

For brands using a Google Ads agency partner like CTC, this adds a coordination step to the onboarding and offboarding process. It also makes access audits more important, because any stale admin accounts or unused logins on your account now represent a security surface that requires coordinated removal rather than a single-click fix.

We have seen how quickly access management can become a liability when brands work with multiple agencies or inherit accounts from prior vendors. The new MPA requirement, while adding a layer of friction, also adds meaningful protection against unauthorized access changes. We covered the broader automation implications in our post on Google Ads new Terms of Service and the July 2026 AI automation changes.

Brands can no longer instantly revoke agency access. A second admin must approve the change, which makes clean account hygiene more important than ever.

What Should You Do Before July 27?

Audit your admin list today. Log into Google Ads, go to Tools, then Access and Security, and review every user with admin access. Remove any accounts that no longer need access before July 27, while single-admin approval is still sufficient.
Identify your second approving admin. Confirm who on your team or at your agency will serve as the second approver for access requests. Make sure that person knows how to find in-product notifications, since email alerts are not sent.
Brief your agency contacts. If you work with an agency, share this change with your main point of contact so both sides understand the new approval workflow before it goes live.
Remove unused accounts now. Any stale logins or former-employee accounts should be removed before the rollout, while you can still do it without a second approval.
Enable in-product notifications. Make sure at least two admins are actively monitoring the Google Ads notification center, since MPA requests expire after 20 days with no email reminder.

How Is Google Securing Ads Accounts in 2026?

Multi-Party Approval is one piece of a larger security initiative Google has been rolling out across Google Ads this year. On July 15, Google began requiring passkey verification for sensitive account actions, including billing changes and adding new users. This passkey requirement applies regardless of how many administrators an account has.

Earlier, on June 17, Google added a new Security Tasks Summary tab to the Access and Security section of Google Ads. This tab surfaces recommended security actions for your account, including flagging accounts with outdated access configurations or missing verification steps.

Taken together, these changes signal that Google is treating account security as a platform-level priority in 2026. Brands of all sizes, from 7-figure DTC operators to 9-figure omnichannel brands, should treat access management as part of their standard campaign hygiene going forward, not something to revisit only when a problem surfaces.

Frequently Asked Questions

Does Multi-Party Approval apply to all Google Ads accounts?

Multi-Party Approval only applies to Google Ads accounts with more than three administrators. Accounts with three or fewer admins are not affected by this rollout. If an account drops to a single admin, MPA is automatically paused until additional admins are added.

Will I get an email when someone submits an approval request?

No. Google does not send email notifications for Multi-Party Approval requests. Admins must check in-product notifications manually inside the Google Ads interface. Approval requests expire after 20 days with no action, so teams need a process to actively monitor these notifications.

Are API users affected by Multi-Party Approval?

No. Read-only roles and API users are exempt from the Multi-Party Approval requirement. Automated integrations, reporting tools, and API-based access are not affected by this change, so your regular campaign management tools will continue working without interruption.

Can my agency still make campaign changes, or is that also restricted?

Campaign management actions, such as adjusting bids, budgets, creative, and targeting, are not affected by Multi-Party Approval. Only access management actions, specifically adding users, removing users, and changing access levels, require the second approval. Your agency can continue managing campaigns without any change to that workflow.

Make Sure Your Google Ads Account Is Set Up for Success

Access security and account hygiene are part of how high-performing brands protect their ad investment. Our team helps 7-figure to 9-figure ecommerce brands build the Google Ads infrastructure that scales, including onboarding, access management, and full campaign oversight.

Talk to Us

Common Thread Collective is the leading source of strategy and insight serving DTC ecommerce businesses. From agency services to educational resources for eccomerce leaders and marketers, CTC is committed to helping you do your job better.

For more content like this, sign up for our newsletter, listen to our podcast, or follow us on YouTube or Twitter.

Google Ads Multi-Party Approval Is Live July 27: What Ecommerce Brands and Their Agencies Must Do Now