TikTok and LinkedIn ad accounts: checks before giving an agency access

TikTok Ads Manager and LinkedIn Campaign Manager are platform-specific paid social account products, not interchangeable agency services. This product comparison sets the access checks to run on each before a client gives a paid social agency access, and marks what still needs an account-specific test. Compare them only after the buyer has chosen the relevant audience and channel. A manual no-new-product baseline remains necessary because an agency may be able to use client-owned accounts without adding another management product.

What to take away

Platform access checks

TikTok Ads Manager and LinkedIn Campaign Manager both use named roles rather than a single 'agency' switch. In TikTok Ads Manager, the practical roles are Admin, Operator and Analyst. Admin can manage users, billing and account settings; Operator can build and edit campaigns; Analyst can view reporting. In LinkedIn Campaign Manager, the roles are Account Manager, Campaign Manager, Creative Manager, Viewer and Billing Admin. Account Manager can manage access and billing; Campaign Manager can build campaigns; Creative Manager can build creatives; Viewer can see performance; Billing Admin handles payment.

Access is granted through the platform's asset manager, not by sharing a password. For TikTok, add the agency to the client's TikTok Business Center as a partner using its Business Center ID, or assign the ad account asset to the agency's Business Center and give the least role that fits. Complete any TikTok business verification request before partner access is used. For LinkedIn, the client needs a LinkedIn Page and Page admin rights to hold the ad account, then assigns access through Business Manager or Campaign Manager's Manage access flow. Revoke by removing the agency user or partner from the asset, not by changing the password.

Before handover, require two-factor authentication on every client admin login. The client should keep at least two named admins, one of whom is not the agency, and should never give the agency the client's login credentials. Agency partner status in the TikTok Marketing Partner programme or the LinkedIn Marketing Partner programme does not by itself grant access; the client still assigns the account and sets the role.

Tracking is a separate access decision. If conversion campaigns are in scope, confirm whether the TikTok Pixel or LinkedIn Insight Tag is already installed, who owns the tag, which events fire and whether consent is captured before the tag loads. For server-side events, confirm whether TikTok Events API or LinkedIn Conversions API is included, who holds the API keys and how consent signals are passed. Do not give an agency live-site tag deployment rights without a change record and a test on a staging page.

Record the exact role assigned to each agency user, the asset it covers, the date of grant and the client-side person who approved it. That record is what makes revocation and exit possible without guessing.

Common evidence grid

TikTok's self-serve account guide states that its setup records legal business name, location, timezone, currency and billing information. LinkedIn's Campaign Manager setup guide describes permissions, payment and optional audience or measurement features. These global first-party statements are not independent findings about English users, suitability or results.

Test before adding agency access

Use a synthetic, non-production account where the platform permits it. Record who can add users, change spend, publish, view billing, alter tracking, export evidence and remove the agency. Repeat the test with an ordinary leaver and an emergency revocation. A feature should remain unknown until the configured account proves it.

Tracking requires its own gate. The ICO's storage and access guidance, finalised in April 2026, addresses online-advertising technologies beyond cookies. Its section on the PECR exceptions for online advertising is blunt: if a service uses storage or access technologies for online advertising, it must get consent and cannot rely on any of the exceptions, and that includes ad measurement and performance. An advertising tag on the client's site, such as LinkedIn's Insight Tag, is therefore a consent question before it is an agency question. Product availability does not decide purpose, lawful basis, transparency, transfers, retention or rights.

Put the agency's data role in a contract

If the agency will upload customer lists for matched audiences or handle conversion data for the client, it is usually processing personal data on the client's behalf. Under UK GDPR Article 28(3), the contract between controller and processor must say that the processor may only process personal data on the controller's documented instructions. It must also say that the processor will not engage a sub-processor without the controller's prior specific or general written authorisation, and that at the end of the contract the processor will, at the controller's choice, delete or return all the personal data.

For a client, that turns into three checks before any upload: the instructions are written down, the agency names any other tool or supplier that will touch the list, and the exit clause says what happens to the data the day the agency is removed from the account.

Keep platform policy and UK clearance apart

TikTok's ad-review record describes review against its policies. LinkedIn's advertising policy describes its own approval process. Neither is UK legal clearance. CAP's misleading-advertising section creates a separate substantiation and comparison check.

Choose the client-owned route that passes the actual permission, privacy, security, accessibility, regulated-product, finance, contract and exit tests. If neither documented product fits the approved channel and control design, retain the current baseline or make no purchase.

Before you act

Common questions

Why was Meta excluded from the comparison?

The article states Meta was excluded because the candidate help route resolved to a login wall during research. The desk included only products with public documentation for account creation or permissions that was accessible without a login, so Meta did not meet that inclusion test.

What did the review actually test?

Nothing was tested live. The review was desk-only, covering public TikTok self-serve setup records, LinkedIn's current Campaign Manager setup record and the client's existing account process. Features, editions, billing, exports and security were not tested.

How should a buyer handle tracking before adding agency access?

Tracking requires its own gate. Under the ICO's storage and access guidance, advertising tags need consent and no PECR exception applies to them. Product availability does not decide purpose, lawful basis, transparency, transfers, retention or rights.