What are agency-run client accounts?

An agency-run client account is an account the client owns and your agency’s staff work in on the client’s behalf. Examples are a brand’s social profiles, its ad accounts and its online store’s seller dashboard. The client stays the owner, and your agency acts within the work the client asked for. The term covers every way your staff get in. That makes it wider than delegated access, which is one platform feature an owner can use to invite people (What is delegated access?).

Which accounts does this cover?

It covers accounts where posts go out, ad money is spent, or orders are handled under the client’s name. Running an account for a client doesn’t move ownership. It means the client trusts your staff to operate it.

Your staff can get in three ways.

1. Delegated access. The client invites your staff through the platform’s own sharing feature, and each person signs in as themselves.
2. A shared login. The client gives you its username and password, and your team uses them.
3. An access management tool (access tool for short). Your agency stores the login in a tool, and staff sign in through it without seeing the password.

In all three, people outside the client’s company operate its account. What differs is who holds the password and what record each use leaves. Managing client accounts at an agency compares the three side by side.

Why are scope of work and access separate questions?

Scope of work is what your agency may do in the account: publish posts, upload ads, change budgets, process orders. The contract or statement of work sets it. Access is how your staff get into the account, who knows the password, and how each use is recorded. Setting the scope doesn’t settle access.

The gap shows with a shared login. The contract may limit your agency to scheduling posts. But anyone who knows the owner’s password can do whatever the owner can, because the platform sees the owner signing in. The platform’s history also names the login, not the person who used it.

So agree on access separately from scope, for each account. Settle how staff get in, who knows the password, how each use is recorded, and what happens when staff change.

What changes when the work involves personal information?

The California Consumer Privacy Act (CCPA) may cover some of your clients. A “business” under the CCPA is a for-profit company that does business in California and decides why and how consumers’ personal information is processed. It must also meet at least one of three thresholds (Cal. Civ. Code 1798.140(d)):

1. More than $25 million in gross revenue in the previous calendar year, adjusted for inflation.
2. Buying, selling or sharing the personal information of 100,000 or more consumers or households a year.
3. Earning 50% or more of its annual revenue from selling or sharing consumers’ personal information.

If your agency processes consumers’ personal information for such a client, under a written contract, you may be its “service provider” (1798.140(ag)).

The business must then have an agreement with you (1798.100(d)). The agreement gives the client the right to take “reasonable and appropriate steps” to help ensure you use the information in line with its own obligations (1798.100(d)(3)). The regulations say those steps may include ongoing reviews and scans, and assessments or audits at least once every 12 months (11 CCR 7051(a)(6)). A questionnaire about who can get into which account is one way a client takes that step. How an agency should answer a client’s security questionnaire covers the answers.

Whether this reaches your agency depends on the work. Drafting and scheduling posts may involve no consumer data. Answering direct messages, collecting contest entries, uploading customer lists for ad audiences or handling store orders does. Check the actual tasks with the client. Where the CCPA doesn’t apply, the reason to explain your access comes from the contract and the relationship.