Working with a white-label tracking and analytics partner: what the agency hands over and what comes back

Baris Asa, tracking consultant, London · Last checked: November 2026

A white-label tracking and analytics partner sets up, audits and repairs GTM, GA4, server-side tagging, Consent Mode and the Meta Conversions API inside your client’s own accounts, under your agency’s name. You give them their own login at the lowest level that does the job and you stay the admin. Every change goes out as a named GTM version, a handover comes back in your template, and the work is billed by the hour: an estimate before the job, a timesheet after.

I’m one of these partners. Who I am and what I take on is on the white-label page. To send a job, email the client’s site and what you need to [email protected]. I usually reply the same day, with an hour estimate.

This note is the working arrangement, step by step, for the agency and for the partner.

How do you vet a white-label tracking partner?

Seven questions, with the answer to look for and why it matters.

Do you work in the client’s own accounts? You want yes. Then the client owns everything when the job ends, and nothing breaks if you change partner.
What access do you need, and why that level? The lowest that does the job, on their own login. A request for the client’s password, or for Admin everywhere, is a risk your agency carries.
Will every published GTM version have a name and a description? You want yes. That’s what makes a change readable a year later, and possible to roll back.
Do you send an estimate before starting? You want one, so you can price the job to your client before anything is spent.
Will you contact our client directly? Only through you, or on a call you set up.
Will you sign our NDA? Before you share client details.
Do you sell anything else to our client: ads, SEO, a build? You want no, so the client stays yours.

Monthly plan, fulfilment team or specialist per job: what changes?

White-label tracking is sold in three shapes. The work is the same; the arrangement around it differs. Ask any partner which one they are.

Model	How scope is set	Who does the work	What to ask
Monthly plan	A set amount per month	A team	What happens to unused time?
Fulfilment team	Tickets or briefs	An assigned team member	Who reviews the work?
Specialist per job	An estimate per job	One named person	What about holiday cover?

I work the third way: one person, an hour estimate per job.

What access does the agency hand over?

The partner’s own login on each account, never a shared password. If you’re not sure who holds the client’s logins, forward them this table.

Platform	Level	What it allows
Google Tag Manager	Publish (or Approve)	Change and publish the container
GA4	Editor	Events, custom dimensions, streams
Google Ads	Standard	Conversions from GA4, once linked
Meta	Pixel shared with a business	Use and analyse the pixel
Shopify	Collaborator or staff	Only the roles you set

For whoever grants the access

Google Tag Manager: give Publish, or Approve if you want to press Publish yourself. Container permissions run Read, Edit, Approve, Publish. Edit can’t create a version. Approve can create one but can’t publish it. With Approve, I build and version the change and you release it (Google: user permissions). Account-level Admin isn’t needed.
GA4: give Editor. Editor has full control of property settings, without managing users. Marketer covers events, key events, audiences and attribution settings. It doesn’t cover custom dimensions or data streams, so most tracking jobs need Editor (Google: access management).
Google Ads: give Standard. Standard edits campaigns and can create conversions from GA4 events and key events (Google: access levels). The GA4 link itself is an Admin step. It needs Admin in Google Ads and Editor or Administrator on the GA4 property (Google: link Google Ads and Analytics). If there’s no link yet, whoever holds Admin makes it.
Meta: share the pixel with a business. Meta calls the pixel a dataset. The owning business shares it with another business by its business ID, with set tasks: analyse, upload conversion data, advertise. If the two businesses aren’t already connected, the receiving business approves the request (Meta: pixel sharing). Each person still logs in with their own Meta account.
Shopify: give a collaborator account. The partner requests it from Shopify’s Dev Dashboard with the 4-digit code you give them (Settings, then Users or Users and permissions, then Security). You accept it with only the roles the job needs. Collaborators don’t count towards the store’s user limit (Shopify: collaborator accounts). A staff account works too, but it takes one of the plan’s user seats.
Server-side GTM: a role on the client’s project. The server container sits in GTM like any other. The server itself usually runs as a Cloud Run service in a Google Cloud project, linked to a billing account (Google: Cloud Run setup). The client creates the project and links their billing. The partner gets a project role that can deploy and manage the service. Ownership and billing stay with the client. If GTM provisions the server automatically, whoever runs that step needs Google’s Project Creator and Billing Account User roles. What server-side can and can’t recover is filed under F-401 .

Will the client see the partner’s name?

White-label hides the name on the report. It doesn’t hide the login.

The report goes out on your template, with your agency’s name, and the client talks to you. The fault codes on this site, such as F-501 , are for my own files. They don’t appear in anything the client gets. The white-label page shows what “your name on the report” looks like.

The logins are different:

Google. A partner’s own email appears in the account’s user list. Their changes appear in GTM’s version history, and in GA4’s change history, which Editors and Administrators can see (Google: access management). The fix: a login on your agency’s domain.
Meta. A pixel shared with the partner’s business shows that business in the client’s settings. The fix: the client shares with your business, and you add the partner as a person in it.
Shopify. A collaborator is shown as a collaborator. The fix: a staff account on an email at your agency’s domain.

Every fix comes down to the same thing: a login under your agency’s domain. Settle this before the job starts. The other arrangement is a named partner: I work alongside you, visible to the client, and you keep the relationship. Both run the same way.

What should the agency send with the job?

Enough that the first hour goes on the fault:

the client’s site, and the page or flow where it breaks (checkout, a form, a thank-you page),
the symptom in plain words, with dates: “Google Ads purchases fell to zero on 14 October”,
what changed around then: a launch, a new theme, a new consent banner, a platform migration,
whether a test order or test lead is allowed, and how to cancel it,
the deadline, if a client report or a launch hangs on it,
your report template, if you want the handover in it.

If you don’t know what changed, say so. Finding out is part of the job.

What comes back when the job is done?

Three things.

The work, in the client’s accounts. Built in a GTM workspace, tested in Preview, then saved as a version with a name and a description of what changed and why. Google’s own example of a version name is “GA page view tag - initial launch” (Google: publishing, versions and approvals). Any earlier version can be published again, so any change can be rolled back.
A handover in your format. What was wrong, what changed, how it was tested, what to watch over the next week. Written for the client to read.
A timesheet. The hours as worked, against the estimate.

A tracking job with no handover is how a container ends up full of tags nobody can explain. That’s a fault on record in its own right: F-501 . The version notes and the handover are how you avoid it.

How is a job estimated and billed?

By the hour, in two steps.

An hour estimate before anything starts. It comes with what looks wrong, usually the same day, so you can price the job to your client.
A timesheet after. If the work looks like running over, you hear before it does, with a new estimate.

If the first look turns up a bigger problem than the one in the brief, it comes back as its own estimate. Rate on request.

How is the work tested before it goes live?

In the client’s accounts, before anything is published:

GTM: Preview mode on the live site, with the changes in a workspace. Nothing reaches visitors until a version is published.
GA4: the events in DebugView, then in the reports once they’ve processed.
Google Ads and Meta: a test conversion where the client allows one. In Meta, server events show in Test Events with a test code (Meta CAPI server events not showing covers how).

If the client won’t allow a test order, say so up front. The test then runs on a staging site, or on the live site with the order cancelled straight after.

When the job ends, what happens to the access?

You remove it, or drop it to read-only, and the client loses nothing. The work lives in the client’s GTM container, GA4 property and ad accounts, and the server runs on their project. Nothing sits in the partner’s accounts.

If you bring the same partner back often, read-only access between jobs saves the access round each time. That’s your call, or your client’s.

Common questions

How does working with a white-label tracking partner work?

The partner sets up, audits and repairs the client’s tracking inside the client’s own accounts, under your agency’s name. You give them their own login at the lowest level that does the job and stay the admin. Changes go out as named GTM versions, a handover comes back in your template, and billing is an hour estimate before the job and a timesheet after.

What access does a white-label tracking partner need?

Their own login, never a shared password. Usually Publish (or Approve) on the GTM container, Editor on GA4, Standard on Google Ads, the Meta pixel shared with their business or yours, and a Shopify collaborator or staff account. Your agency stays the admin. The access table above gives the reason for each.

Will the client see the partner’s name?

Not on the report, the calls or the handover. But logins show: an outside email in the user list and change history, a partner business in Meta, a collaborator label in Shopify. If the client mustn’t see an outside name, give the partner a login on your agency’s domain everywhere: Google, a person in your own Meta business, and a Shopify staff account.

What should come back after a white-label tracking job?

The changes, published in the client’s own accounts with a name and description on every GTM version. A handover in your template: what was wrong, what changed, how it was tested, what to watch. And a timesheet against the estimate.

What happens if the job grows beyond the estimate?

You hear before the hours run over, with a new estimate. If the first look turns up a bigger fault than the one in the brief, it comes back as its own estimate, and you decide whether it goes ahead.

Who owns the setup when the job ends?

The client, as before. The work lives in the client’s GTM container, GA4 property, ad accounts and, for server-side, their own Google Cloud project or hosting account. At the end, you remove the partner’s access or drop it to read-only.

Sources

Read on 4 November 2026:

Google Tag Manager Help, user permissions (Read, Edit, Approve, Publish) and publishing, versions and approvals (version name and description, publishing an older version)
Google Analytics Help, access and data-restriction management (Administrator, Editor, Marketer, Analyst, Viewer; change history for Editors and Administrators) and link Google Ads and Analytics (Editor or Administrator in GA4, Admin in Google Ads)
Google Ads Help, about access levels (Standard and conversions from GA4; Admin for product links)
Google for Developers, server-side tagging on Cloud Run (Cloud Run service, billing account, Project Creator and Billing Account User)
Meta for Developers, pixel sharing (sharing a pixel with another business by business ID, tasks, approval)
Shopify Help Center, collaborator accounts (Dev Dashboard request, 4-digit code, roles, user limit)