# Reporting your work in client accounts to the client

Take who, when and what from each platform's change history. Where a shared login hides the person, fill in from your work log and mark each line's source.

Updated: October 16, 2026

A work report that says who did what, and when, can draw on two sources. One is the history each platform keeps, such as Google Ads or Microsoft Advertising. The other is the work log your agency keeps itself. In the regular monthly report, mark which source each line came from. The platform's history is recorded whether or not anyone reports it, while your log depends on what staff write down. Reporting after a mistake is covered in [tracing a wrong post or setting back to the person who made it](/guides/agency-accounts/tracing-misposts).

## Why clients ask for records

When your work involves consumers' personal information, California's privacy law can give the client a reason to ask. Under the California Consumer Privacy Act (CCPA), a "business" that discloses personal information to a service provider must have a contract with it. A "business" here is a for-profit company doing business in California that meets a size or data threshold. The contract has to let the business take reasonable steps to help ensure the provider uses the information in line with the business's own obligations (Cal. Civ. Code 1798.100(d)(3)). The definition of "service provider" adds that the contract may let the business check compliance. The listed means include manual reviews, automated scans, and assessments or audits at least once every 12 months (1798.140(ag)(1)). That wording is permissive, so how often you report and in what form comes from the contract. A request for records with each work report is one way a client checks. When the work doesn't touch personal information, the reason comes from the contract and the relationship. [Managing client accounts at an agency](/guides/agency-accounts) covers where the CCPA applies.

Your agency has its own reason to keep records. When a client asks who changed a budget, the same records are your answer.

## What platform histories show

Google Ads, Microsoft Advertising, Meta and Shopify each have a screen that shows who changed what. Here is what their help centers say.

| Platform and screen | What the "who" column shows | How far back | Download a file |
| --- | --- | --- | --- |
| Google Ads change history | Email address of the person, for changes made in the Google Ads interface | 2 years | Not stated in the help article |
| Microsoft Advertising change history | The user, which you can filter by Changed by | Six months | Not stated in the help article |
| Meta Ads Manager activity history | The person's name | Not stated | Not stated |
| Meta Business Suite business history | Acting user's name and ID | A date range you pick | CSV, needs full control |
| Shopify store activity log | The person, app or channel | Up to 250 results | Can't be exported |

Full control here means the right to manage everything in a Meta business portfolio, the place where a business keeps its ad accounts and Pages. Business history lists actions such as adding people, changing roles and giving partners access. For changes to the ads themselves, open the activity history in Ads Manager.

Keep three points in mind when you use these screens in a report.

- The "who" column names a login, not a person. Google Ads shows the email address of the account that made the change. If five people share one Google account, all five show up as that one address.
- Some lines aren't staff work. Google Ads may list automated changes under names like "Google Ads system." Microsoft Advertising shows Administrator when it makes a system change, such as pausing a campaign whose budget has run out. Meta shows the rule's name for automated rules, and "Meta" for its ad review system. Shopify shows "Shopify" for some background work.
- Names can disappear later. In Meta Ads Manager, changes by someone who has been removed from the ad account show as "Meta." Google Ads Help also notes that some account-level settings changes may not be listed.

## Naming the person behind a shared login

When your team shares one login, the platform's "who" column shows only that login. The person's name has to come from your own records. For each action, log the date and time, the account, the staff member, what was done, and who asked for it.

A work log depends on staff writing it, so a forgotten entry leaves no trace. Once a month, line up the platform's history and your log by time. A line that appears in the history but not in your log is either an unlogged change by your staff or the client's own change under the same login. Ask your staff and the client about each one. If no one can confirm it, report it as "person unknown." Don't present a best guess as if it were a record.

Matching logs is a stopgap until staff have their own access. Where a platform lets the client invite people, each invited person shows up in its history under their own name. Meta's Terms of Service also say users must not share their password or give others access to their Facebook account (section 3.1). Keep log matching for platforms with no way to invite people, and for accounts still waiting to switch. [What is delegated access?](/guides/agency-accounts/what-is-delegated-permission) explains the switch.

## What to put in the report

{: .checklist}
1. **The period and the accounts covered**

   State up front which period and which accounts the report covers.

   **Why** An account with no activity should show up as having none, not go missing.

2. **Who could get into each account**

   List the staff who had access during the period, with the dates anyone was added or removed. In Meta Business Suite, someone with full control can download each person's role and last active date.

   **Why** The client can then check that every name in the activity list belongs to someone allowed in.

3. **The list of actions**

   Give the date and time, the person, and what was done, such as budget changes, new ads, posts or setting changes.

   **Why** The client can check that the work stayed within what the contract covers.

4. **Where each line came from**

   Note whether the line came from the platform's history or from your work log.

   **Why** The client can see which lines to double-check.

5. **Changes that weren't staff work, and lines you couldn't confirm**

   List automated rules, platform system changes and the client's own changes separately, along with any action you couldn't tie to a person.

   **Why** Mixing them into staff work tells the client the wrong person did it.

## When to pull the records

Because these histories don't go back forever (see the table), pull the history every time you report. Where there's no download, take screenshots. Store them with your work log. On the day you remove a staff member, pull their part first, because Meta Ads Manager drops removed people's names. Then, when a client asks about a change six months later, you can answer from records made at the time.


## Frequently asked questions

**Can we report changes made under a shared login by staff name?**

The platform shows only the shared login, so the name has to come from your own work log. Mark those lines as coming from your log, not from the platform's history.

**How far back do platform change histories go?**

It varies. Google Ads keeps two years, Microsoft Advertising keeps six months, and Shopify's store activity log shows up to 250 results.

**What happens to a person's name after we remove them?**

In Meta Ads Manager, changes by someone removed from the ad account show as "Meta." Save that person's history before you remove them.

**Is reporting our work to the client a legal requirement?**

Not directly. Under the CCPA, the client's contract with you must let it take reasonable steps to check how you use personal information. The contract may allow audits, so it sets how and how often you report.

## Sources

- [California Civil Code 1798.100 (California Consumer Privacy Act)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100)
- [California Civil Code 1798.140 (definitions, including "service provider")](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140)
- [Google Ads Help: About change history](https://support.google.com/google-ads/answer/19888?hl=en)
- [Microsoft Advertising Help: What changes were made to my campaigns and can I undo them?](https://help.ads.microsoft.com/apex/index/3/en/50840)
- [Meta Business Help Center: How to view activity history for your ads across Meta technologies in Meta Ads Manager](https://www.facebook.com/business/help/289211751238030)
- [Meta Business Help Center: Download people permissions and business history in Meta Business Suite](https://www.facebook.com/business/help/996373447409365)
- [Shopify Help Center: Shopify admin activity logs](https://help.shopify.com/en/manual/shopify-admin/activity-logs)
- [Meta Terms of Service, section 3.1 (effective January 1, 2025)](https://www.facebook.com/legal/terms)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** With Junify, you no longer ask staff who made each change under a shared login before every report. Change the password with the client at setup so only Junify holds it, and the only way in is through Junify. Junify records who opened the account and when, so you can match that to the platform's history. On accounts where the admin turns on recording, you can see what was done, with an AI summary.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=reporting-work-records-to-clients)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Account clauses an agency should propose in its client contract](/guides/agency-accounts/account-clauses-for-service-providers): Propose five: account handover, who may use accounts, records, incident notice, and offboarding. Keep your own promises apart from what the client must do.
- [How to write client account handling into your agency's security policy](/guides/agency-accounts/agency-security-policy-for-clients): Write a short public policy, an internal policy for staff, and an access summary for each client. Rewrite template rules for logins the client owns.
- [Amazon Seller Central user permissions, and how to give an agency access](/guides/agency-accounts/amazon-seller-central-user-permissions): Seller Central Help says not to share logins. On a Professional plan, the seller invites staff as employees and authorizes your agency as a Service Provider.