Google Ads Tightens Account Security: Free Email Ban, Mandatory Passkeys, and Multi-Party Approvals

Google Ads has initiated an extensive enforcement overhaul across its account governance architecture, rolling out a suite of defensive controls aimed at eliminating ad account hijacking. Forensics across agency audits revealed that compromised credentials previously allowed attackers to gain administrative access, attach unauthorized manager accounts, and exhaust credit limits in under seven minutes. To stop this attack vector, Google is transitioning from passive notifications to strict protocol-level gates, including restricting free email domains from performing sensitive modifications, enforcing device-bound passkeys, and introducing Multi-party Approval.

A primary vulnerability in enterprise PPC management has long been the use of personal consumer email addresses to manage corporate ad spend. Google Ads is currently piloting an enforcement policy that directly prevents users accessing accounts via free email providers—specifically calling out @gmail.com, @yahoo.com, @hotmail.com, and @aol.com—from completing sensitive account operations. While personal email logins may retain routine campaign reporting access, administrative tasks such as altering user access levels, editing banking instruments, or authorizing manager links will mandate verified corporate-domain Google Accounts.

To neutralize rogue credential attacks, Google has introduced Multi-party Approval (MPA). Under this protocol, when one administrator initiates a critical modification, the action is suspended until a second authorized company administrator reviews and confirms the request. Sensitive workflows subject to MPA include inviting new users, removing existing personnel, changing permission roles, linking to an external Manager Account (MCC), and updating primary billing configurations.

Crucially for marketing teams and agencies, Google Ads official documentation confirms that Google Support representatives cannot override, approve, or bypass a pending Multi-party Approval request. If an organization maintains only one active internal admin and that individual departs without delegating permissions, the account enters administrative paralysis—a scenario that has already caused multi-week operational freezes for enterprise advertisers during agency transitions.

Alongside administrative redundancy, Google is elevating identity verification through passkeys utilizing the WebAuthn standard. Rather than relying on SMS two-factor authentication or static passwords that remain vulnerable to session hijacking and reverse-proxy phishing, administrators are prompted to authenticate sensitive actions using device biometric sensors (Touch ID, Face ID, Windows Hello) or physical FIDO2 security keys like YubiKeys.

Account managers can monitor implementation under the Access and Security console, which now displays a dedicated Passkey Status indicator for every user. Technical teams must account for propagation latency: Google notes that newly registered passkeys require a pairing window of 24 to 48 hours before being fully recognized by the Google Ads security engine, meaning passkey onboarding cannot be deferred to moments of emergency account triage.

To prevent sudden lockout during peak Q4 promotional cycles, search marketing leaders should immediately conduct an access audit across all direct and linked MCC accounts:

1. 1.Transition administrative users away from personal consumer email addresses to corporate-domain accounts.
2. 2.Ensure every production Google Ads account has at least two—preferably three—active company employees with Administrative clearance to satisfy Multi-party Approval thresholds.
3. 3.Verify that all administrative personnel establish and pair hardware-bound passkeys in advance.
4. 4.Restrict the Allowed Domains panel under Access and Security to internal company domains, removing deprecated agency domains and consumer webmail providers.
5. 5.Audit user rosters to purge historical contractors, inactive vendors, and unverified legacy accounts.

• Google Ads Is Tightening Account Security: 5 Things Advertisers Need to Do Now — JumpFly
• About Multi-Party Approval for Google Ads — Google Ads Help
• Use a Passkey to Complete Sensitive Actions — Google Ads Help