Shopify Agency Red Flags to Check Before You Sign

Quick answer: The red flags that matter most are rarely in the pitch. They sit in three places you can check yourself: who owns the ad account, analytics property and store, whether the agency’s numbers can be reproduced from your own Shopify admin, and whether the contract is as easy to leave as it was to sign. Run those checks before you sign and take the questions below into the sales call. We are an agency too, so the list applies to us, and the last section shows how.

If an agency has burned you once, you know the pitch is not where the damage happens. It happens later: reports that never match your orders, an ad account you cannot get into, a contract you cannot leave.

This post turns those problems into five checks, each with a clear pass and fail, for the owner of a Shopify store in Australia or the US who is about to hire an agency or suspects the current one is not working.

Three points first. Prism3 is an agency, and we sell Shopify SEO, GEO and CRO only. We do not run ads or email, so the ad-account check is about whoever you hire for those, not us. Nothing here names an agency or says any particular one does these things; one flag can have an innocent explanation, and several together are a reason to slow down. Platform rules below come from each platform’s own help pages, as at 31 October 2026. They change, so check the current version.

The five checks at a glance

Guaranteed results, vague scope and slow replies are fair warnings, but hard to test on a sales call. These five are concrete: who holds the keys, whether the numbers reconcile to something you control, and what the exit looks like on paper.

Check 1: Who owns the ad account, the pixel and the audiences?

This matters most if anyone will run Meta ads for you. An ad account holds your spend history and campaign results. The pixel and audiences sit alongside it, so ownership of those matters too.

How Meta organises ownership. Meta’s Business Help Centre describes a “business portfolio” as the home for a business’s accounts: Pages, ad accounts, Instagram accounts, apps and more. Its page on adding an ad account lists three options: create a new account, claim an existing one into your portfolio, or request to share an account owned by another business. For the third, Meta’s example is an agency working for a client, and it says the account stays in the client’s portfolio while access is shared with the agency’s. Once an account is in a portfolio, people can only be given access to manage it through that portfolio.

That is the red flag in one sentence. If the ad account sits in the agency’s portfolio, the agency decides who gets in. If it sits in yours, you do. The same goes for the data around it: Meta lists datasets and pixels, custom conversions, shared audiences, catalogues and business creative folders as data sources in a business portfolio.

How partner access works. Meta says only someone with full control of a business portfolio can share its assets with a partner or remove one (Settings, then Partners). A partner can get full control of an asset or partial access for tasks such as managing ads, and even a partner with full control cannot pass the asset on to another business. The arrangement to look for: your portfolio owns the assets, the agency is a partner with the access the work needs, and you can remove it when you leave.

The five-minute check. Open Settings in Meta Business Suite for your own business portfolio. If you cannot see Partners in the menu, Meta says you may not have full control of the portfolio, and if you have no portfolio at all, that is worth knowing before the call. Then see which ad accounts sit under it, which partners are connected, and who is listed under People. Ask whose payment method is on the ad account.

Ask on the call: Which portfolio will own the ad account, the pixel or dataset and the audiences? Who pays the platform, and do I see its own invoices? If we part, what do I keep, and in what form?

A good answer is “your portfolio, our partner access, you can remove us any time.” A bad answer is “it’s easier on our side,” “we’ll hand it over when the contract ends,” or a request for your personal Facebook login. Settle this at the start: I found no Meta page promising an account can be moved out of a portfolio later, so do not assume it can.

Check 2: Who is the Administrator in Google Analytics?

Analytics holds your history, and it is where an agency’s reporting should be checkable. Google’s help page on GA4 access roles lists Administrator, Editor, Marketer, Analyst and Viewer. Administrators have full control, including adding and removing users. Editors control property settings but cannot manage users. Marketers can create and edit audiences, events and key events, and edit attribution-model settings.

Two details matter. Only Administrators manage users: you need the role at account or property level to add or edit them, and at account level to delete them, so if the agency is the only Administrator and you are an Editor or Viewer, you cannot remove it. And roles inherit: a role at account level applies to every property in it, and effective permission is the most permissive role a user holds, so check both levels.

The check. In GA4, open Admin, then Access Management at account level and again at property level, and read every name and role. You want your own email as Administrator at account level, the agency on Editor, Marketer or Analyst rather than Administrator, and no unfamiliar personal addresses.

Ask on the call: Whose Google account will create the property, and will I be an Administrator at account level? What role do you need, and why not a narrower one? Can I see the same reports in my own login?

A bad answer is that the agency will set it up under its account and give you read-only access, or that reports exist only in a dashboard you cannot open yourself.

Check 3: Who controls your Shopify store?

Shopify’s help centre says that creating a store creates a Shopify account, and that the Billing, Plan, Users and General pages in Settings are where bills, plan, users and ownership are managed; ownership can be changed or transferred from General. If an agency built your store, find out whose account it was built under.

For outside help, Shopify’s collaborator accounts page describes the route it provides for Partners. As at 31 October 2026 it says:

• You give the partner a 4-digit request code, then review each request and set the role’s permissions, or reject it.
• Collaborators cannot be given the Administrator store role, and store ownership cannot be transferred to one.
• Access expires after 90 days without a login. Removal is permanent, though the collaborator’s name and actions stay in activity logs and order timelines.
• Shopify says collaborators can request and be given all available permissions, so the missing Administrator role is not a cap on what you can hand over. Its advice is to give only the permissions you are comfortable giving, and to ask the agency why if you are unsure why it needs one.

Shopify describes collaborators as Shopify Partners you have allowed to access your store, so the route assumes the agency has a Partner account.

The check. Settings, then Users. Who is the owner, and whose email is on billing? Do you recognise every name? Does anyone have a broader role than their task needs? Does the agency appear as a collaborator, a named user, or through a login you handed over? A shared login is the worst option: you cannot tell who did what.

Ask on the call: Will you use a collaborator request, and which permissions do you need for the first month? Does anyone on your team share a login?

For the search side, including Search Console ownership, see Shopify SEO agency red flags.

Check 4: Do the agency’s numbers match your Shopify orders?

This one is easy to skip because it is invisible until you look. A report can be honest and still impossible for you to check.

Why the numbers differ. Meta’s help page on attribution lets an advertiser choose, at ad set level, how conversions are credited. The standard settings count events within 1 or 7 days after a link click, and within 1 day after an impression of the ad (view-through). Meta also says results cannot be compared in the campaign overview table across ad sets using different attribution models, and that if you use external analytics tools you should evaluate performance in those. Shopify’s marketing attribution view defaults to last non-direct click, and Shopify notes that each platform applies its own rules, so the same sale can be counted by more than one.

Neither number is a lie; they answer different questions. The red flag is an agency that only ever shows one, or will not say which setting it used. See why Meta shows more sales than Shopify and GA4 vs Shopify Analytics.

A worked example (illustrative, not from any store). A report says: ad spend A$10,000, Meta-reported purchase value A$40,000, return on ad spend 4.0. In Shopify you find total sales for the month of A$60,000, of which Shopify’s marketing attribution credits A$22,000 to Meta.

Either 4.0 or 2.2 might be profitable; that depends on your margin, not the report. What matters is the A$18,000 gap. It could come from view-through windows, from sales Shopify credits to email or direct, or from double counting. An agency worth hiring can say which settings it used and where the gap might hide. One that says “ignore Shopify” is telling you not to check.

What to ask for before you sign. One table every month, built from systems you own: spend from the platform’s own billing; platform-reported purchases and value, with the attribution setting named; Shopify orders and sales, total and credited to the channel; the gap and the reason; and any change since last month in the attribution setting, tracking set-up or definition of a conversion. That last line catches a quiet red flag: metrics that change definition so periods cannot be compared.

The same test applies to SEO and CRO: organic clicks should be visible in your own Search Console, and conversion rate should come from a source you can open. A number you cannot reproduce is a claim, not a result.

Ask on the call: Which attribution setting will you report on, and will you change it? Can I see a sample report with the client’s name removed? If your number and my Shopify number disagree, which do we decide on, and why?

A good answer puts Shopify beside the platform figure and explains the difference. A bad answer is “Shopify doesn’t track properly,” a dashboard you cannot export, or a number that grows every month with no breakdown.

Check 5: Can you leave?

A weak report is fixable while you are free to leave, so read the exit before the scope.

What the ACCC says. The Australian Competition and Consumer Commission (ACCC) explains that the law protects small businesses from unfair terms in standard form contracts. As at 31 October 2026, its contracts page says changes took effect on 9 November 2023 and cover standard form contracts made or renewed on or after that date. The ACCC says small businesses are covered for any new or varied standard form contract from that date if they have fewer than 100 employees or make less than $10 million in annual turnover. Whether your contract is covered is a question for a lawyer. A standard form contract is a pre-written, take-it-or-leave-it contract.

Its test for an unfair term has three parts: it causes a significant imbalance in the parties’ rights and obligations, it is not reasonably necessary to protect the legitimate interests of the party that benefits, and it would cause financial or other harm if enforced. The examples it lists of terms that may be unfair include ones that let one party but not the other end the contract or change the terms, and ones that penalise one party but not the other for breaching or ending it. In its broadband example, a price-change term is likely unfair if the customer cannot leave over it, and likely not unfair if the customer can leave without penalty.

Two limits: the law does not apply to terms that set out the upfront price, so the headline price is not tested this way, and only courts decide whether a term is unfair. The ACCC says it does not give legal advice. This is general information, not legal advice. I am not saying any particular clause is or is not unfair, and nothing here tells you an agreement complies with anything. If you do not understand a contract, the ACCC’s advice is to talk to a lawyer.

Clauses to find. You do not need to judge fairness to find these:

• Term and renewal: how long is the first term, does it renew automatically, and by when must you say no?
• Notice: how much does each side need, and is it the same?
• Exit costs: a fee for leaving early, or paying out the remaining months?
• Change clauses: can fees or scope change mid-term, and can you leave if they do?
• Handover: do you get access, reports, creative files and tracking documentation on exit? Who owns the work?
• Minimums and guarantees: a minimum ad spend? What exactly is guaranteed, and what is the remedy? A guarantee of a result the agency does not control is a flag in itself.

A long term is not automatically bad; some work takes months. The question is whether the exit works both ways and whether you leave with your assets. Shopify SEO retainer vs project covers the formats.

What to do with a fail

Two more tests cost nothing on the call. Count how many questions the agency asks about your margins, best sellers and where orders come from before it quotes. And ask for a case study that names its source and date window, not only a percentage. How to choose a Shopify CRO agency goes deeper.

If you are already signed

You do not need a dispute to check. In order: check ownership (Partners in Meta Business Suite, Administrator at account level in GA4, owner in Shopify); ask in writing to be added as owner or Administrator wherever you are not; export last quarter’s orders from Shopify and compare them with the reports; read the exit clauses and note the dates for renewal, notice and handover. Only then remove anyone, because Shopify’s collaborator removal is permanent.

If it still looks wrong, see what to do when your Shopify SEO agency is not delivering.

Apply the list to us

An agency cannot mark its own homework, so here are plain statements to hold us to. We sell Shopify SEO, GEO and CRO. We do not run ads, email or SMS, so the ad-account check is about whoever you hire for those. We do not guarantee rankings or AI-assistant citations. Engagements are month to month with no long-term lock-ins. On our SEO work you get a progress report every two weeks and a monthly report that ties the work to revenue and conversion outcomes, not impressions. You talk to the founder, who does the work.

Our work needs access to your analytics and store, which is why ownership matters. With us or anyone, insist that your business owns each account and the agency is a user inside it. Ask us every question above. What is Prism3 Agency has the plain description.

Key takeaways

• Ask which business portfolio will own the ad account, pixel and audiences before you sign. Meta says a shared account stays in the owner’s portfolio.
• In GA4 only Administrators can add or remove users. Be an Administrator at account level; give the agency a narrower role.
• In Shopify, check the owner and the Users list, and use a collaborator request, never a shared login.
• Platform and Shopify numbers differ because they count differently. Ask for a monthly table showing both.
• Read the exit first. The ACCC says only courts decide whether a term is unfair, and this is not legal advice.
• Ownership failures are a stop sign, reporting failures are fix-before-signing, and contract failures are negotiable.

FAQs

What are the biggest red flags when hiring a Shopify agency?

The ones you can test: an agency that wants to own your ad account, analytics property or store; reports you cannot reproduce from your Shopify orders; and an exit that is hard or expensive. Guarantees and vague scope are warnings too, but they are judgement calls.

Who should own the Meta ad account when an agency runs my ads?

Your business, in your business portfolio. Meta describes sharing an ad account with an agency as a partner arrangement: the account stays in the owner’s portfolio and access is shared.

Should an agency have admin access to my Shopify store?

Not by default. Shopify’s collaborator route lets you approve a Partner’s request, set the permissions and remove them later. Collaborators cannot be given the Administrator store role, but Shopify says they can be given all available permissions, so read the permission list, not just the role name. Grant what the first month needs, and avoid shared logins.

How do I check that an agency’s reported revenue is real?

Compare it with your Shopify orders for the same dates. Expect a gap, because Meta credits conversions using click and view windows while Shopify’s marketing view defaults to last non-direct click. The test is whether the agency shows both and explains the difference.

Is a long agency contract always a red flag?

No. The question is whether the exit works both ways. The ACCC lists one-sided exit, penalty and change terms among examples that may be unfair in standard form contracts, and says only courts decide. This is not legal advice, so have a lawyer read anything high stakes.

Keep reading

• Attribution on Shopify in 2026, and what to trust
• What to do when your Shopify SEO agency is not delivering
• How to choose a Shopify CRO agency

Want to ask us the same questions?

Ask us the same questions you would ask any agency; we are one, and this checklist applies to us. If you want a second opinion on an agency you are weighing, or on numbers you have been sent, tell us about your store or book a free 30-minute diagnostic: we look at where your store loses buyers after the click, using your own numbers, and tell you what to fix first. We do not run ads or email. No pitch. No email gate.

If the problem turns out to be tracking or conversion, our CRO service includes tracking audit and repair before any optimisation.