Once you’ve set up your Google tag, you can share the responsibility of managing your Google tag by choosing who can administer your tag and who can edit your tag's settings. This article describes Google tag user roles and permissions, explains how user management works, and provides step-by-step instructions for adding, editing, and removing users.
Before you begin, make sure you’ve set up your Google tag and configured your tag settings.
User roles and permissions
Each Google tag user has both a role and a permission.
User roles
There are two Google tag user roles: User and Administrator.
The User role allows the user to view other tag users and the tag configuration.
Users with the Administrator role can:
- manage users
- add or remove destinations
- combine or split Google tags
User permissions
In addition to user roles, there are two Google tag user permissions: Read and Publish.
Users with Read permission can view users and configurations for a tag, but they can't make any changes.
Users with Publish permission can:
- View users for a tag
- Update settings
They can't manage users, add/remove destinations, or combine/split Google tags, unless they also have the Administrator role.
How user access works
User access for the Google tag works differently depending on how many destinations you've linked to your Google tag.
User access if your Google tag has a single destination
If your Google tag has one destination (either a Google Ads account or a Google Analytics web data stream), the tag's users are controlled by the destination's access levels. The specific role and permission for each Google tag user is inherited from that user's Google Ads access level or Google Analytics role.
The following two tables show how Google Ads access levels and Google Analytics property roles correspond to the Google tag administrator role and editor permissions. Review the "User roles and permissions section" (above) to learn about each of these roles and permissions.
Mapping Google Ads access levels to Google Tag permissions
Google Ads access level |
Tag Administrator role (inherited) |
Tag Editor permission (inherited) |
Admin | Administrator | Publish |
Standard | None (will inherit User) |
Publish |
Read only | None (will inherit User) |
Read |
Billing | None | None |
Email only | None | None |
Learn more about access levels in your Google Ads account
Mapping Google Analytics property permissions to Google Tag permissions
Google Analytics property role | Tag Administrator role (inherited) |
Tag Editor permission (inherited) |
Administrator | Administrator | Publish |
Editor | None (will inherit User) |
Publish |
Analyst | None (will inherit User) |
Read |
Viewer | None (will inherit User) |
Read |
Learn more about Access and data-restriction management in Google Analytics
Mapping Campaign Manager access levels to Google Tag permissions
Campaign Manager 360 Floodlight access level |
Tag Administrator role |
Tag Editor permission (inherited) |
Admin | Administrator | Publish |
Full access | Administrator | Publish |
Read-only | None (will inherit User) |
Read |
In Campaign Manager 360, you can optionally allow Google support representatives to configure your tag settings. If this setting is turned on, then Google support representatives will have admin access to your Google tag. This setting is only relevant for Google tags that are associated with Campaign Manager 360 destinations.
To allow Google support representatives to configure your tag settings:
- Open Campaign Manager 360.
- Under “Floodlight”, click Google tag.
- Click the Admin tab.
- Click the Allow Google support team to perform operations on your behalf toggle.
User access if your Google tag has multiple destinations
If your Google tag has multiple destinations, each user on those destinations automatically inherits the Google tag role and permission that corresponds to the destination's access levels. (See the tables in the previous section.)
In addition to these users with inherited roles and permissions, you can directly add users to your Google tag if it has multiple destinations.
Access your Google tag
Google Ads instructions
- In your Google Ads account, click the Tools icon .
- Click Google tag.
Google Analytics instructions
- In Admin, under Data collection and modification, select Data Streams.
Note: The previous link opens to the last Analytics property you accessed. You can change the property using the property selector. You must be an Editor or above at the property level to set up your Google tag.
- Click the data stream that you want to edit.
- Under “Google tag“, click Configure tag settings.
Campaign Manager 360 instructions
- Open Campaign Manager 360.
- Under “Floodlight”, click Google Tag to edit the Google tag settings.
Google Tag Manager instructions
- Sign in to Google Tag Manager.
- On the “All accounts” screen, click “Google tags”.
Select the Google tag you want to access
Directly add users
Once you've added a user, you can edit a user's access level, or you can always remove access later on.
- Access your Google tag screen.
- Go to the "Admin'' tab.
- Click Choose who can administer this tag or Choose who can edit this tag's settings.
- Click the Add user icon .
- Enter email addresses.
- If you're adding users who can administer the tag, select roles ("Administrator" or "User") and permissions ("Publish" or "Read").
- If you're adding users who can edit the tag, select permissions ("Publish" or "Read").
- Review your selections, and click Invite.
New users are sent an email invitation to access the account, so they can have the following user status:
- "Has access": Can access tags and settings based on access level
- "Invitation pending": Hasn't yet accepted invitation
Edit directly added users
You need to have the Administrator role on a Google tag with multiple destinations to edit directly added users.
- Access your Google tag screen.
- Go to the "Admin'' tab.
- Click Choose who can administer this tag or Choose who can edit this tag's settings.
- Click the row for the user you want to remove.
- Make your desired changes to the user role and/or permissions, and click Save.
Remove directly added users
- Access your Google tag screen.
- At the top of the page, click the Admin tab.
- Click Choose who can administer this tag or Choose who can edit this tag's settings.
- To remove a single user:
- In the row for the user you want to remove, select Remove access from the 3 dot menu .
- Review the confirmation message, and click Remove.
- To remove multiple users:
- Select the checkbox for each user you want to remove.
- At the top of the list, click Remove.
- Review the confirmation message, and click Remove.