- Google is piloting a block on free-domain logins for exactly two things: account linking updates and user access changes. Campaigns keep serving and routine edits still work.
- Access changes cluster at the end of a client relationship, and revoking access is the half that happens when nobody is answering messages.
- A user removal can need a second administrator. Those requests expire after 20 days, Google sends no email for them, and support cannot approve on your behalf.
- New passkeys take about one to two days to pair with Google Ads, so a corporate login cannot be set up the morning somebody quits.
Quick answers: Does this mean my account gets suspended? · Which addresses count as a free domain? · How many admins trigger Multi-Party Approval? · What if an approval request is ignored? · Do I need a new passkey?
A new Google Ads help document, reported on August 6, 2026, describes a security change most advertisers will never notice (Search Engine Land). Agencies will notice it on their worst day.
What Google changed, and what it did not
The rule is narrow. Google says users signed in with a free domain email address, “such as @gmail.com or @yahoo.com,” will be “blocked from completing sensitive actions and must transition to a corporate email domain” (Google Ads Help). Two actions are named: account linking updates and user access changes. It is a pilot, running on a subset of advertisers, and enrolled accounts get an email notification.
The word “blocked” is what makes people misread this. Free domain users can still “view reports and make routine campaign edits depending on their access level,” and a gated action returns an in-app prompt telling you to switch addresses. Campaigns keep serving and your optimization score recommendations keep arriving. Only the administrative door is locked.
Two things Google does not say. There is no stated end date for the pilot. And the list of gated actions is not complete: Google calls it “non-exhaustive and subject to change without prior notice.” The document also defines a free domain by function rather than by naming providers, as an address “provided by a public, non-corporate email service where any individual can sign up for an account without proving ownership of a specific business, domain, or organization.”
So Gmail and Yahoo are examples, not the roster. If you did not have to own a domain to create the address, assume it is in scope.
Why agencies and solo buyers are the exposed group
Advertisers with an IT department already pass this test. Their staff log in as name@company.com because that is the only mailbox they were ever issued, so an enrolled account gets the notification email and then nothing else happens.
The exposed group runs on personal logins. Freelance media buyers, small agencies and brokers routinely hold client accounts under a personal Gmail, often the one they started the business with. That login handles daily management fine. It fails at one category of task, and it is the category that carries the money.
Access changes cluster at the end of a relationship. You grant access when you win an account and you revoke it when you lose one, and only one of those two happens while everybody is still answering messages. If you are choosing a media buying agency or weighing a retainer against pay-per-lead, who physically holds account access is now much harder to unwind after the fact.
What breaks the day you remove someone
Removing a user is itself a gated action, and a second control sits behind it. Under Multi-Party Approval, “adding a new user, removing an existing user, or changing user roles will require approval from a second administrator” (Google Ads Help). Read-only roles and API users are exempt. Three details decide whether that is a formality or a problem.
- Requests expire after 20 days. If no admin acts, the request is rejected and you start again.
- Google sends no email for them. The documentation is blunt: “Since emails aren’t sent for these approvals, it’s important to check your in-product notifications regularly.” The approval you are waiting on sits in a notification panel nobody opens.
- Support cannot break the tie. Google Ads support “can’t approve or deny the request for you,” so you have to reach your other administrators, which is awkward when the person you are removing is one of them. As with the six-month limit on policy appeals, when Google closes a self-serve door, support is not the backup.
Count your admins, and assume the lower threshold. Google’s own two pages disagree here: the email-domain document says Multi-Party Approval triggers at “3 or more active administrators,” while the Multi-Party Approval document says it “is only applicable for accounts with more than 3 administrators.” Both are current, neither is marked as superseded, and the gap between them is exactly one administrator, which is the difference between a user removal you can complete on your own and one you cannot. Plan for three.
The 30 minute account access audit
Do this while the relationships are still good. Each step below names the exact screen, so you can run it without guessing where Google moved the setting this quarter.
- Count admins and check passkey status. Go to Admin > Access and security. The user table lists access levels and a “Passkey status” column.
- Invite a corporate address. In Admin > Access and security, click the blue plus button, enter yourname@yourcompany.com, assign Admin or Standard, then accept the invitation from that inbox.
- Set Allowed domains, but only after step 2. Go to Admin > Access and security > Security > Allowed domains > Add domain > Save. Setting example.com means you can invite user@example.com and not user@gmail.com (Google Ads Help). Set it before your corporate admin is in and you lock out the invitation you still need.
- Create the passkey now, not later. A passkey is tied to one Google Account, so a corporate login needs its own, and Google warns that “new passkeys take about one to 2 days to pair with Ads.” Passkeys resist phishing because the credential is bound to the site that issued it, what standards bodies call verifier impersonation resistance (NIST SP 800-63B, FIDO Alliance). This step cannot be done the morning somebody quits.
- Check whether you can move the whole team at once. The formal switch-to-business-email flow requires Cloud Identity or Google Workspace with a verified domain, and gives each user a four week grace period (Google Ads Help). If you do not run a managed domain, skip it and repeat step 2 per user.
None of this is new in spirit. It follows the automation terms you accepted this year: Google keeps narrowing what an account can do without a verified business behind it, and the access layer is the last part of the account to get that treatment.
Frequently Asked Questions
Does this mean my Google Ads account gets suspended?
No. The pilot blocks specific actions, not accounts. Google states that users on free domain addresses can still view reports and make routine campaign edits according to their access level, and that a gated action returns an in-app prompt to switch addresses. Campaigns keep serving. The restriction covers account administration, specifically account linking updates and user access changes.
Which email addresses count as a free domain?
Google names @gmail.com and @yahoo.com as examples but defines the category by function, not by a published list: an address “provided by a public, non-corporate email service where any individual can sign up for an account without proving ownership of a specific business, domain, or organization.” The practical test is whether creating it required proof that you own a domain.
How many admins trigger Multi-Party Approval?
Google’s own pages give two answers. The email domain document says three or more active administrators. The Multi-Party Approval document says it applies only to accounts with more than three. Both are live documentation, so assume the lower figure. At three admins, plan for a second approval on every user change.
What happens if an approval request is ignored?
It expires. Administrators have 20 days to approve or reject, after which the request is rejected automatically. Google sends no email for these requests, so they appear only as in-product notifications. Support cannot approve or deny on your behalf, so an unresponsive co-administrator can stall a user removal indefinitely.
Do I need a new passkey for my corporate login?
Yes. Passkeys are tied to one Google Account, so a corporate address needs a credential separate from the personal login it replaces. Google notes that new passkeys take about one to two days to pair with Google Ads. Set it up when you onboard the corporate login, not when you first need a gated action.
If you buy calls or leads and an agency currently holds your Google Ads access under a personal address, the audit above is a half hour that costs nothing today and is very hard to run later. Talk to us about how your accounts are set up.
