Remove the agency's named users from the tag manager, analytics and ad accounts on the last day, then review every tag, trigger and variable they added. Rotate any shared credentials, check for tags that load code from the agency's own domains, and record the date and the person who confirmed it.
Why agencies need a plan of their own
Agencies often hold edit or publish rights across several of your accounts, and they may have added scripts hosted on their own domains. After the contract ends, those scripts keep running in your visitors' browsers until someone removes them. OWASP's third party JavaScript guidance recommends restricting tag manager publishing access and reviewing changes as application code. Offboarding is the moment to apply both.
Checklist
Before the end date
- List every account the agency touches: tag manager, analytics, ad platforms, consent tool, CMS, DNS, social, email.
- Ask the agency for a list of tags and scripts they added, including any hosted on their domains.
- Agree a handover date and which of your staff will take ownership.
On the end date
- Remove the agency's users from each container. Google's Tag Manager permissions are set per container, with levels from Read to Publish, and account Admins can change them. Remove at both levels where they appear.
- Remove them from analytics and ad accounts as well.
- Rotate any shared logins, API keys or tokens they had. Shared accounts should not exist, but if they do, replace them with named users.
- Revoke any connected apps or integrations the agency authorised.
Within a week
- Review the container version history for what the agency added or changed. Read each Custom HTML tag, as covered in Custom HTML tags policy.
- Search the container and templates for URLs on the agency's domains and remove or replace each.
- Check that tags you keep have an internal owner and a purpose.
- Run a page load with the network panel open and confirm no requests go to the agency's domains.
What to record
| Item | Evidence |
|---|---|
| Users removed | Screenshot or export of the user list, with date |
| Tags reviewed | List with keep, change or remove decision |
| Credentials rotated | Ticket reference, not the secret |
| Final network check | Date and reviewer |
Keep these in your change log so you can answer an auditor or a customer who asks how third parties are managed. A related walkthrough is vendor offboarding with data return and access removal.
Common misses
Domain and DNS access is the one people forget, since an agency that controls DNS can redirect traffic. Another is the agency's own conversion pixels left in a template. A third is analytics properties that the agency owns, which leave with them. Insist that you own the property and give the agency access, not the other way round.
Try it yourself
Click through it at your own pace, or open it full screen. Look for the owner field, then check that every tag in your container has an internal one.
Quick check
Is removing the agency's users enough?
No. Scripts they added keep running until you remove them, so review the container contents too.
Who should own the analytics property?
You should. Give the agency access rather than ownership.
Where Safeguard fits
Safeguard's dependency scanning and SBOM cover the code and packages you ship; agency access in your tag manager still has to be removed by hand. Try the free scan.
Sources
Last reviewed: 19 October 2026.
