TL;DR
When an employee leaves, disabling their corporate login often leaves access to apps, ad accounts, business portfolios, and DSP seats in place. Paid social and programmatic access carries more risk than organic access, and we’re not talking about this growing problem enough. This lingering access can change campaigns, direct ad spend, and expose audience and performance data.
In a recent LinkedIn poll, 75% of respondents said they still had access to at least one former employer’s or client’s social accounts. We need to treat every departure, agency change, and contract end as a trigger to inventory, revoke, and verify access inside each platform.
Picture the end of a perfectly ordinary agency relationship. Marketing signs with a new media agency, the old one sends a friendly goodbye email, and procurement closes out the contract. Somewhere in IT, someone marks a ticket resolved, and everyone moves on to the next thing.
Nobody touched the old agency’s access, with partner-level permissions in the company’s Meta Business Manager, mind you. Its media buyer can still sign into the DSP account they used to run the company’s programmatic campaigns.
No HR event fired, so no offboarding workflow ran. The ad account is still active, the agency still holds a role inside it, and depending on that role, someone there can still change campaigns or spend budget under the brand’s name. 😱
When security teams think about social media, they usually think about the publishing profile: a hijacked handle or a post nobody approved. The paid side of the house tends to get less attention, even though it controls the budget, audience data, and admin access. This guide walks through why that access deserves the same lifecycle controls as the rest of your identity program, and how to find the gaps in about 20 minutes.
The access question
Many organizations already manage access to their organic social accounts. But a brand’s publishing profile is not necessarily the same asset as its advertising account, business portfolio, or associated administrative roles. Paid social can introduce additional permissions, partners, billing relationships, and privileged access that deserve the same lifecycle controls.
An employee departure, agency change, or completed contractor engagement should end the access granted for that work. But disabling a corporate login or closing a contract may not remove direct platform invitations, business-manager roles, partner grants, shared credentials, or ownership assigned inside an ad platform or DSP. If those permissions remain, a person or partner may still be able to sign in, act on your brand’s behalf, change campaigns, or spend budget, depending on their role. The account stays active; the authorization to use it should not.
What marketers say
In a recent poll on LinkedIn, 21% of respondents said they had access to a past employer’s or client’s social media account. 54% said they had access to multiple. Only 8% reported having no access.
| How many people still have access to a previous employer’s or client’s social media accounts (organic or paid) | Share of respondents |
|---|---|
| Yes, access to multiple | 54% |
| Yes, just one | 21% |
| No, but access lingered | 17% |
| No | 8% |
A departure date or contract end date usually triggers a verification of access, but not proof that the access was actually removed. The same review applies when an agency is replaced, a freelance media buyer finishes a project, or a contractor rotates off the account.
Organic and paid social carry different kinds of risk
| Asset | What access can enable | What to establish |
|---|---|---|
| Organic social profile | Publish, edit, or remove content; respond as the brand; change some page or profile settings depending on permissions | Who has access, what role they hold, and how access is removed when responsibilities change |
| Advertising account | Create or alter campaigns; change targeting or creative; pause activity; and, depending on role and platform, influence or authorize advertising spend | Which users have campaign, admin, billing, or other privileged roles separate from the organic profile |
| DSP / programmatic buying platform | Create or alter programmatic campaigns; change budgets, audiences, inventory, or targeting; access performance data; and, depending on role, direct media spend across publishers or channels | Who owns each advertiser seat, who has admin or buying privileges, which agencies or partners are attached, and how access is revoked |
| Business manager / portfolio | Administer connected assets, users, partners, and permissions across multiple social or advertising properties | Who owns the container, who holds privileged roles, and whether any former employee or external partner remains attached |
| Agency / partner access | Allow external teams to operate on brand and advertising assets, sometimes across multiple accounts | Who approved access, what assets it covers, how long it should persist, and who is responsible for revocation |
The risk depends on what access remains and what the role permits. Organic publishing access can enable unauthorized posts, messages, or profile changes. Paid social access can add campaign changes, audience exposure, and unauthorized spending. DSP access can extend those consequences across programmatic campaigns, advertiser seats, and multiple publishers. Not every role permits every action, so you need to review permissions asset by asset.
What changes when the account can spend?
Consider three common transitions. A departing employee retains a direct invitation to an ad account after their corporate account is disabled. A former agency keeps a partner grant to Business Manager or a DSP advertiser seat after the new agency takes over. A freelance contractor retains campaign permissions after a launch ends.
If those grants are not explicitly reviewed and revoked, the former user or partner may still be able to change creative, targeting, budgets, or campaigns, and in some roles initiate spend. Separately, if the departing party is the sole owner or administrator, the business may lose the ability to operate or recover its own account.
| Risk | Organic social access | Paid social / ad accounts / DSPs |
|---|---|---|
| Brand and reputation | Post, edit, delete, or respond publicly as the brand, depending on permissions | Can create or alter ad creative and messaging that appears under the brand. In paid channels, those changes can be amplified through active media spend |
| Financial exposure | Usually limited direct spend exposure from the organic profile itself | Depending on permissions, can launch or modify campaigns, increase budgets, direct company ad spend, or change programmatic buying settings across paid social accounts and DSPs |
| Operational disruption | Can disrupt publishing, community management, or account recovery | Can pause campaigns, alter targeting or inventory, disrupt lead generation, interfere with billing, change partner access, or block current teams from administering active media |
Paid access can also expose more than money. Social ad platforms and DSPs may contain audience definitions, campaign strategy, performance data, billing details, connected data, partner relationships, inventory and buying controls, and privileged roles. What is visible or changeable depends on the platform and permission level, which is exactly why role-level inventory matters.
Organic access asks: “Can they still speak as us?”
Paid social and DSP access add: “Can they still spend as us, change our campaigns, or access our audiences?”
The common root is access that survives the job, contract, or agency relationship that originally justified it.
What this looks like in the real world
In public, self-reported Reddit discussions, one organization described a former employee who could still switch into its business account long after leaving. Another described a museum whose only Business Manager administrator had departed. A newly hired marketer reported being unable to complete advertising payment setup because an unidentified former employee remained associated with the business account. These are illustrations, not verified incident reports or evidence of frequency, but they reflect real and common occurrences.
These self-reported stories illustrate different failure modes: a former user retaining access, an ex-employee remaining the only administrator, and campaigns blocked because the current team cannot control the account. Agency changes and contractor end dates create the same need to verify revocation and ownership, even when no employee leaves.
Marketing professionals who responded to the LinkedIn poll described the same thing from the other side:
“I have had access to a previous employer’s socials (and ad accounts!) for over 7 years. I have asked them to remove me. They don’t. It’s mind-boggling to me.” — Jess Cook, VP of Marketing
“Probably 8-9 right now. Both social and various ad platforms, plus Search Console. The number would be double digits if I didn’t proactively reach out to let them know they need to kick me.” — Tamara Ceman, Head of Marketing
“Why do they do that? I’ve reached out to former clients and asked them to remove me but they don’t seem to care. Good thing that I don’t go into their accounts anymore or have intentions on doing something with them. It’s a major security breach issue on their end.” — Ari Paulin, Sr. Social Strategist
“Yes, multiple! Sometimes you can’t remove yourself...so I’ve made sure to have a paper trail of me requesting that past clients remove me.” — Tom Basgil Jr., VP of GTM & Growth
“Still have access to a client’s LinkedIn six years later...” — Kiran Shahid, B2B Content Writer
Find your paid social access gaps in 20 minutes
- Inventory advertising platforms in use, including Meta, LinkedIn, X, Reddit, and DSPs used for programmatic media buying.
- Record each actual ad account, advertiser seat, business portfolio, and DSP instance, not just platform names.
- Identify the business owner, technical administrator, privileged users, service identities where applicable, and external agencies for each asset.
- Map access paths: direct user assignments, business-manager roles, partner grants, and any shared or recovery credentials.
- Reconcile permissions against employee departures and role changes, completed contractor projects, agency replacements, expired partner agreements, and existing managed assets. Check both direct user access and organization-to-organization partner grants.
- Prioritize orphaned ownership, standing administrator access, unknown external access, accounts or DSP seats with active spend, and any role that can change budgets, payment settings, audiences, inventory, campaigns, partner access, or other users.
- Review gaps with the Cerby team to confirm platform support, onboarding prerequisites, and applicable identity-management workflows.
Ask account owners for the full picture
Send this to your marketing or social media team:
We’re reviewing access across our social and advertising environment after employee changes, completed contractor work, and agency transitions. Please share the organic profiles, social ad accounts, business portfolios, DSP advertiser seats, and related assets you manage; their owners and administrators; current agency and contractor grants; and any access that should have ended. We’ll compare this inventory with existing coverage and identify supported accounts to bring under management.
Make the next review measurable
Track these with every review:
- Accounts discovered
- Privileged roles reviewed
- Access confirmed revoked
- Supported accounts not yet onboarded
- Former-agency partner grants awaiting removal
- Assets with sole or unknown administrators
- Departed employees and completed contractor engagements with access still present
Recheck after every agency handoff and contract end, not just employee offboarding.
Extend identity coverage beyond the publishing profile
- Bring your organic, paid social, and DSP inventory to the Cerby team.
- Confirm supported platforms and applicable capabilities.
- Identify additional accounts for coverage.
- Prioritize active-spend assets, external partner access, and ownership gaps.
- Verify revocation in each platform rather than assuming terminated employment or an agency relationship removed access.
Three transitions that should trigger an access review
1. An employee leaves or switches roles. Their corporate identity may be disabled while a personal login, direct platform role, or shared credential remains active. Confirm removal from each relevant social profile, ad account, business portfolio, and DSP seat.
2. An agency changes. The outgoing agency may still hold a partner-level grant, advertiser-seat access, or the only administrator or ownership role. Confirm ownership stays with your business, revoke the outgoing agency’s grants, and validate that the incoming agency has only the permissions it needs.
3. A contractor finishes. A freelance buyer, creative specialist, or consultant may have been invited directly for a short project. Check expiration and remove their individual permissions, tokens, or shared credentials where applicable, as well as any access to audiences, reporting, or billing.
For every transition:
- Identify assets
- Identify direct and partner permissions
- Transfer ownership if needed
- Revoke unneeded access
- Verify removal in the platform
- Document the result
Access should end when the work does
Every identity program has a clear answer for what happens when an employee leaves. Paid social and programmatic platforms are where that answer gets fuzzy, because access there was granted inside each platform, usually by marketing, and often to agencies and contractors who never appeared in the HR system. The accounts keep running, the budgets keep spending, and the permissions stay exactly where someone left them.
This is a very solvable problem, and it starts with an inventory. Map every ad account, business portfolio, and DSP seat; identify who can act on each one; and make every departure, agency handoff, and contract end a reason to check. Then bring those accounts under the same lifecycle controls as the rest of your stack, so access leaves when the person or partner does.
If you’re curious how Cerby can help, let’s talk.
FAQ
Why is paid social access riskier than organic social access? Organic access lets someone publish or respond as the brand. Paid social and DSP access can also let them change live campaigns, raise budgets, direct ad spend, and view audience and performance data, depending on the role. DSP access can extend those consequences across many publishers at once.
Does disabling a user’s corporate account remove their access to ad platforms? Often it doesn’t. Ad platforms commonly grant access through direct invitations, business-manager roles, and partner grants that live inside the platform, so they can keep working after the corporate login is disabled. You have to verify removal in each platform.
Why don’t agency changes trigger offboarding? Most offboarding workflows run on HR events, and replacing an agency or ending a contractor engagement usually doesn’t create one. An outgoing agency’s partner grant or advertiser seat stays in place until someone revokes it directly, which makes every agency handoff its own review trigger.
What is a DSP, and why should security teams care about it? A demand-side platform is software used to buy programmatic advertising across many publishers from one place. Access can include budgets, audiences, inventory, and advertiser seats, so lingering access there can affect spend and data well beyond a single social network.
What should we prioritize first in a paid social access review? Start with assets that have a sole or unknown administrator, since the business may not be able to operate or recover them. Then look at accounts and DSP seats with active spend, external access nobody can explain, standing administrator access, and any role that can change budgets, payment settings, audiences, or other users.
Who should own paid social access governance, marketing or security? Both have a role. Marketing knows which accounts exist and who needs access, and security and identity teams set the policy for granting, reviewing, and revoking access. The review works best when marketing supplies the inventory and identity applies the same lifecycle controls it uses everywhere else.
How often should we review access to ad accounts and DSPs? At every employee departure or role change, every agency handoff, and every contractor end date, plus whatever recurring access review cadence your program already runs.