4 Digital Marketing Agency Red Flags

They ask for your social media passwords. 

When you sign up for a social media account, either personally or for business, you agree to the terms of never sharing your login information. If something goes wrong as a result of a login share, you have no protection. Agencies that are operating in your best interests will limit password sharing only to accounts that leave no other choice and will not ask for passwords to accounts that can be managed through admin access.

If you’re having someone set up social media accounts for you from scratch, ensure the final step of account set up is to transfer ownership to you. 

Whether or not a shared password is necessary for account management is dependent on the channel.

Facebook and Instagram: Managed via Meta Business Suite. Invite agency members by visiting Settings<Users<People and click “Invite.” Enter their email address and the highest level of access needed to do the job they’re assigned to do.

LinkedIn Company Page: Managed through company page settings. Navigate to Manage Admins and click “Add admin.” You will be prompted to search for a member to assign them a role. Agency members who need access should provide you with the link to their LinkedIn profile to ensure you are inviting the correct people. As of the date of this post, Super Admin is required for page editing but also allows for the addition or removal of page roles. If you are hiring someone who will be responsible for editing the page, create a calendar alert to periodically review the admin on the page and be sure to question your agency about anyone who is unfamiliar to you that has page access.

YouTube and Google Analytics: Managed through account settings. Invite admin via their email address, providing only the access type they need to complete the job.

Linkedin personal pages and TikTok: As of the date of this post, LinkedIn personal accounts and TikTok accounts do not have a system in place for multiple users unless you’re looking at the ads account managers.

With LinkedIn being a huge platform for leadership content, you may have several personal accounts you wish your agency to manage. The safest way to do this is to have the individuals grant access to their accounts via a third party management software like Sprout Social. The agency can then publish content to those profiles without needing direct access. However, due to the nature of LinkedIn’s API, this is the only function that is available. They will not be able to manage comments or messages for those personal accounts unless they have password access.

While you can grant access to TikTok’s Business Suite to individuals via email, this access does not extend to organic efforts. Third party software like Sprout Social has the ability to manage content and engagement for TikTok but tends to be out of the price range for small businesses. Agencies will not be able to manage comments or posts for TikTok unless they have password access or a third party tool that integrates with TikTok. 

They want to manage your accounts on a third party software that they own and control. 

While using a third party software like Sprout Social, Sprinklr, or Hootsuite is a safe and efficient way to manage your accounts, it is important that you understand the implications of not owning or controlling your own account.

If you part ways with your agency, you will lose access to your historical data and will have to set up your accounts and reports from scratch.

Some agencies have enough clients that they are able to offer the use of one of these third party services to clients who otherwise would not be able to afford it on their own. If it is acceptable to you that you will only have access to this data for as long as your work with this agency, at minimum you should be granted a seat in the platform that allows you to add and remove access to your social media accounts, turn off automated posting in the case of emergency, and see performance metrics.    

They want to own your ads account.

Similar to the last point, your organization should be the owner of your ads accounts across channels, granting agency members the access they need to run your ads. If they own your accounts, and they are suspended for violation of platform guidelines for another client, your ads will be affected.

By retaining ownership, you will always have access to your budgets, analytics, reports, and learnings. And you will be able to shut down your ads on a moment’s notice in case of emergency.

They use fake profiles for access to your channels.

If your agency members are using a fake account on Facebook or LinkedIn to manage your pages, you are at risk. It is a terms of service violation on many social media channels to have more than one account or to run a fake account. If the agency is using a fake account and that fake account is the page or ad account owner, and the account gets suspended for terms violations, you may lose access to your account forever.

Be wary of agencies who insist this is ok or common practice. If they’re this loose with the terms of service of the platforms they use, the security of your accounts are likely not a top priority. Many agencies who do this do it because they do not want you to know who is in your account doing the work. Either because they have an extremely high turnover, or because they hire out cheaper agencies to execute. Regardless, these unethical business practices create a security nightmare and eventually lead to trouble. 

How to Stay Safe.

When hiring an agency, be sure to ask the following questions prior to signing a contract agreement:

• How do you plan to access our accounts? 
• What access levels are required and what are the names of the people who will require access?
• Will we retain ownership of our accounts once our engagement ends?
   

Keep looking until you find an agency that will take the security of your accounts and customers as seriously as you do. Do not bend on the safety of your business.