What access does an ad agency actually need to run my Google Ads and Meta accounts?
An agency does not need your account password or full account ownership. Both Google Ads and Meta Business Manager support tiered, role-based access, such as "Standard" or "Admin" user access in Google Ads granted by email invitation, or specific asset-level permissions in Meta Business Manager, that let an agency manage campaigns without you handing over full administrative control or billing access.
In practice, you invite the agency as a user on the account and assign a role that fits what they need to do, whether that's editing campaigns, viewing performance data, or managing billing separately. No login credentials change hands at any point, and you can revoke that access at any time from your own account settings without needing to change a password.
If an agency asks you for your actual username and password rather than requesting to be added as a user with a defined role, that's worth questioning. It's not how either platform is designed to be used, and it removes your ability to see exactly what access you've granted or to revoke it cleanly later.