Reporting your work in client accounts to the client

A work report that says who did what, and when, can draw on two sources. One is the history each platform keeps, such as Google Ads or Microsoft Advertising. The other is the work log your agency keeps itself. In the regular monthly report, mark which source each line came from. The platform’s history is recorded whether or not anyone reports it, while your log depends on what staff write down. Reporting after a mistake is covered in tracing a wrong post or setting back to the person who made it.

Why clients ask for records

When your work involves consumers’ personal information, California’s privacy law can give the client a reason to ask. Under the California Consumer Privacy Act (CCPA), a “business” that discloses personal information to a service provider must have a contract with it. A “business” here is a for-profit company doing business in California that meets a size or data threshold. The contract has to let the business take reasonable steps to help ensure the provider uses the information in line with the business’s own obligations (Cal. Civ. Code 1798.100(d)(3)). The definition of “service provider” adds that the contract may let the business check compliance. The listed means include manual reviews, automated scans, and assessments or audits at least once every 12 months (1798.140(ag)(1)). That wording is permissive, so how often you report and in what form comes from the contract. A request for records with each work report is one way a client checks. When the work doesn’t touch personal information, the reason comes from the contract and the relationship. Managing client accounts at an agency covers where the CCPA applies.

Your agency has its own reason to keep records. When a client asks who changed a budget, the same records are your answer.

What platform histories show

Google Ads, Microsoft Advertising, Meta and Shopify each have a screen that shows who changed what. Here is what their help centers say.

Full control here means the right to manage everything in a Meta business portfolio, the place where a business keeps its ad accounts and Pages. Business history lists actions such as adding people, changing roles and giving partners access. For changes to the ads themselves, open the activity history in Ads Manager.

Keep three points in mind when you use these screens in a report.

• The “who” column names a login, not a person. Google Ads shows the email address of the account that made the change. If five people share one Google account, all five show up as that one address.
• Some lines aren’t staff work. Google Ads may list automated changes under names like “Google Ads system.” Microsoft Advertising shows Administrator when it makes a system change, such as pausing a campaign whose budget has run out. Meta shows the rule’s name for automated rules, and “Meta” for its ad review system. Shopify shows “Shopify” for some background work.
• Names can disappear later. In Meta Ads Manager, changes by someone who has been removed from the ad account show as “Meta.” Google Ads Help also notes that some account-level settings changes may not be listed.

Naming the person behind a shared login

When your team shares one login, the platform’s “who” column shows only that login. The person’s name has to come from your own records. For each action, log the date and time, the account, the staff member, what was done, and who asked for it.

A work log depends on staff writing it, so a forgotten entry leaves no trace. Once a month, line up the platform’s history and your log by time. A line that appears in the history but not in your log is either an unlogged change by your staff or the client’s own change under the same login. Ask your staff and the client about each one. If no one can confirm it, report it as “person unknown.” Don’t present a best guess as if it were a record.

Matching logs is a stopgap until staff have their own access. Where a platform lets the client invite people, each invited person shows up in its history under their own name. Meta’s Terms of Service also say users must not share their password or give others access to their Facebook account (section 3.1). Keep log matching for platforms with no way to invite people, and for accounts still waiting to switch. What is delegated access? explains the switch.

What to put in the report

When to pull the records

Because these histories don’t go back forever (see the table), pull the history every time you report. Where there’s no download, take screenshots. Store them with your work log. On the day you remove a staff member, pull their part first, because Meta Ads Manager drops removed people’s names. Then, when a client asks about a change six months later, you can answer from records made at the time.