What Should Be in a Marketing Agency Contract? A Founder's Checklist

A marketing agency contract should make three things unambiguous: who owns the ad accounts and data, how the management fee is separated from ad spend, and how you leave with everything you built. Most disputes between a company and its agency trace back to one of those three being vague. A good contract is not a formality to sign quickly — it is the document that decides whether, when the relationship ends, you walk away with your Google Ads history, your Meta pixel and your data, or you start again from zero. This is the clause-by-clause checklist, written from the side that signs these contracts.

Operator guidance from an agency that signs and honours these contracts — not legal advice. Check specifics with a lawyer for your jurisdiction and situation.

TL;DR

• Ownership is the clause that matters most. The contract should state that you own the ad accounts, data and audiences, and the agency merely manages them with revocable access.
• Ad spend is your cost, paid to the platform — never the agency's revenue. The contract must separate the management fee from the money that goes to Google or Meta.
• The scope of work (SOW) is the firewall against scope creep. Define what is included and what is extra.
• Notice and offboarding decide the exit. A fair notice period is around 30 days; watch for 60–90 day locks and slow access hand-back.
• Auto-renewal is the most common trap — a clause that silently re-locks you for another year.
• IP should assign to you on payment — you should own the creative you paid for.
• A DPA is usually required where the agency handles personal data on your behalf.
• The thesis: access is not ownership — the billing profile and account structure decide, so put both in writing.

The anatomy of a marketing agency contract

A complete marketing agency contract covers twelve areas. Each is a place a relationship can go wrong, and each should be explicit rather than assumed.

1. Parties and services — who is contracting, and what the agency will do.
2. Scope of work (SOW) — the specific deliverables, and what is out of scope.
3. Fees and payment — the management fee, model and terms.
4. Ad spend — separated from the fee, defined as the client's cost paid to the platform.
5. Account and data ownership — who owns the accounts, data, pixels and audiences.
6. Intellectual property — who owns the creative, content and code.
7. Term and termination — duration, notice period and how the relationship ends.
8. Offboarding — how access and assets are handed back, and how fast.
9. Reporting, KPIs and SLAs — what will be reported and what is promised.
10. Confidentiality and NDA — how sensitive information is protected.
11. Data protection (DPA) — how personal data is handled under GDPR/UK GDPR.
12. Liability and platform risk — who bears which risks.

The rest of this guide takes the load-bearing clauses one at a time — the ones where vague wording costs you money or your assets.

Scope of work: the firewall against scope creep

The SOW is where a contract earns its keep day to day. It defines exactly what the agency will deliver — which channels, how many campaigns, what cadence of work — and, just as importantly, what is not included. Without a clear SOW, every new request becomes a negotiation, and the relationship drifts into either scope creep (the agency doing ever more for the same fee, resentfully) or nickel-and-diming (every small ask billed as extra).

A good SOW lists deliverables specifically enough to be checkable, states what falls outside them, and defines how out-of-scope work is quoted and approved. The test is simple: could a third party read the SOW and tell whether a given task is included? If not, it is too vague. This clarity protects both sides — you know what you are paying for, and the agency knows where the line is.

Fees and ad spend: keep them separate

This is the clause that causes the most financial confusion, and the separation is non-negotiable: the management fee is the agency's revenue; ad spend is your cost, paid to the platform. A contract that blends them — a single number that includes "media" — hides how much you are paying the agency versus how much reaches Google or Meta, and it creates a conflict of interest if the agency's fee is a percentage of spend (they earn more by spending more, whether or not it works).

The contract should:

• State the management fee separately from ad spend as distinct line items.
• Define who holds the payment method — ideally you pay the platforms directly on your own billing profile, so the spend and its history stay yours.
• If the fee is a percentage of spend, cap it or tier it, and pair it with performance accountability, so the incentive is not simply "spend more."
• Never treat ad spend as agency revenue — money paid to a platform is your cost, and the contract should say so.

The deeper treatment of these models — including a fair performance clause — is in marketing retainer vs project vs performance.

Account and data ownership: the clause that matters most

If you read only one clause carefully, make it this one. When the relationship ends, the single question that determines whether you keep or lose years of work is: who owns the accounts and data? The right answer, in almost every case, is you — the client owns the ad accounts, the analytics, the pixels and the audiences, and the agency manages them through revocable access.

The critical distinction is access is not ownership. An agency can and should have access to run your accounts, but access is a permission that can be revoked; ownership is who the account and its billing profile belong to. The good structure is client-owned-and-linked: your Google Ads account sits under your own billing, and the agency's manager account (MCC) is linked to it with access. The bad structure is agency-owned: the account lives inside the agency's own account, on the agency's billing, and when you leave, the history, data and sometimes the account itself stay behind.

This extends across every platform, not just Google Ads:

• Google Ads — your account, your billing profile; the agency's MCC is linked, not the owner.
• Meta — your Business Manager owns the ad account, Page, pixel and datasets; the agency is added as a partner. Meta ad accounts generally do not move between Business Managers, so starting in your Business Manager from day one matters.
• GA4 — your property, your account; losing it means losing history permanently, because a new property starts from zero.
• Google Search Console, Merchant Center, Tag Manager — yours, with agency access.
• The pixel / Conversions API and tagging layer — often the real prize, because the conversion history and audiences compound over time; whoever hosts and owns them holds a compounding asset.
• TikTok, CMS, and other platforms — same principle: client-owned, agency-accessed.

The thesis to remember: the pixel and conversion history are a compounding asset you must own. Every month of clean conversion data makes the platform's bidding smarter; lose it, and a new account cold-starts the machine learning. A contract that leaves the accounts on agency billing is leaving your most valuable, hardest-to-rebuild asset in someone else's hands. The full platform-by-platform mechanics are in who owns your Google Ads, Meta and GA4 when you leave an agency.

Term, notice and offboarding: how you leave

The exit clauses are tested exactly when the relationship is worst — when you have decided to leave — so they must be fair and specific. Three elements:

• Term — month-to-month, or a fixed initial term. A fixed term is not inherently bad, but a long one (12 months) should be earned with a milestone review, not assumed.
• Notice period — around 30 days is fair and standard; 60–90 days is steep and worth questioning; anything longer starts to look like a lock-in.
• Offboarding SLA — how fast access and assets are handed back after termination. A fair contract commits to returning access within a defined window (for example, 48 hours to a few business days), not "when convenient."

The offboarding clause is where hostage situations happen: an agency that is slow to hand back access, or that ties the return of accounts and data to settling final invoices, can hold your business hostage. A good contract decouples the two — you pay what you owe, and you get your assets back on a defined timeline regardless.

Auto-renewal: the most common trap

The single most common trap in agency contracts is silent auto-renewal: a clause that automatically renews the contract for another full term unless you give notice within a narrow window (say, 30–60 days before the renewal date). Miss the window, and you are locked in for another year.

Auto-renewal is not automatically unfair — continuity has value — but it must be transparent: a reasonable renewal term, a clear notice window, and ideally a reminder before it triggers. Watch for the combination that traps clients: a long term, a long notice period, and an auto-renewal with a narrow window. Read the renewal clause before signing, and diarise the notice window the day you sign.

Intellectual property: assign on payment

You should own the creative, content and code you paid for. The clean standard is IP assigns to the client on payment — once you have paid for an ad, a landing page or a piece of content, it is yours, including the source files. Watch for clauses where the agency retains ownership or grants you only a licence, which can mean you cannot use your own creative if you leave, or must keep paying to use it.

Two nuances: source files (not just the exported asset) should be included, so you can edit and reuse the work; and where the agency uses genuinely proprietary tools or templates, it is reasonable for those to stay the agency's, as long as your specific deliverables assign to you.

Reporting, KPIs and the limits of guarantees

The contract should define what will be reported, how often, and against which KPIs — but it should also be honest about what can be guaranteed. A credible agency commits to activities and effort (best-efforts / duty of care), not to guaranteed outcomes it cannot control. Be wary of any contract guaranteeing a specific result — a #1 ranking, a fixed number of leads, a guaranteed ROAS — because the variables (competition, platform changes, your own conversion rate) are not fully in the agency's hands. What a good contract promises is defined deliverables, transparent reporting, and KPIs framed as targets with a clear attribution method, not as guarantees.

Confidentiality, DPA and liability

Calling an agency a “processor” in the contract does not settle the role. The factual question is who determines the purposes and essential means of each processing activity. An agency acting only on documented client instructions will usually need an Article 28 processor agreement. If it reuses personal data for its own purpose, it may become a separate controller for that operation.

The DPA should cover subject matter, duration, purpose, data and data-subject categories, confidentiality, security, sub-processors, rights requests, incident support, audits, and deletion or return at exit. The European Commission's controller–processor standard clauses provide an official Article 28 reference. UK programs need the UK GDPR version and current ICO guidance; international transfers require a separate transfer mechanism analysis.

The acceptance and offboarding matrix

A contract becomes operational when every deliverable has an acceptance test and post-handover owner:

IP language must match the governing law. A US work-made-for-hire clause is not a universal substitute for assignment. UK and EU agreements should separate bespoke client work from the agency's pre-existing tools, templates, libraries, stock licenses, and open-source components. Moral rights, source files, portfolio use, and rights effective on payment need explicit treatment.

Three protective clauses round out the contract:

• Confidentiality / NDA — protects your sensitive business information both ways.
• Data protection (DPA) — where the agency processes personal data on your behalf (customer lists, lead data, audiences), a Data Processing Agreement is usually required under GDPR/UK GDPR, defining the agency as processor and you as controller. An NDA is not a substitute for a DPA. The role can be more complex than it looks — some activities make the agency a joint controller — which is covered in is your marketing agency a data controller or a processor.
• Liability — who bears which risks, including platform risks (account suspensions, policy changes) that neither side fully controls. Reasonable liability clauses allocate these fairly rather than dumping all risk on one side.

Glossary

• SOW (scope of work) — the specific deliverables and boundaries of the engagement.
• MSA (master services agreement) — the overarching contract terms, often with SOWs attached per project.
• Management fee — the agency's revenue, distinct from ad spend.
• Ad spend — the client's cost paid to the platform, never the agency's revenue.
• Account ownership — who the ad account and its billing profile belong to (versus who has access).
• MCC (manager account) — Google Ads manager account an agency links to a client's account for access.
• DPA (data processing agreement) — the contract governing personal-data handling under GDPR.
• Auto-renewal — a clause renewing the contract unless notice is given in a set window.

Red-flag clauses to strike

How Space Ads approaches the agency contract

We sign these contracts from the agency side, and our view is that a fair contract protects the client from agencies — including the failure modes we have seen elsewhere. The pattern that damages companies is a contract that reads fine until they try to leave: accounts on the agency's billing, a long notice period, creative they cannot take, and a slow hand-back. Nothing looked wrong at signing; everything went wrong at the exit.

Our approach is to make the load-bearing clauses explicit in the client's favour: client-owned accounts and data with our access as revocable manager, fee and ad spend as separate line items, IP assigning on payment, a ~30-day notice, and a defined offboarding SLA so access and assets return fast regardless of final invoices. That is the contract layer beneath performance marketing; when the need is senior ownership of the whole marketing relationship, a fractional CMO engagement carries the same principles.

FAQ

What should be in a marketing agency contract?

A marketing agency contract should cover scope of work, fees separated from ad spend, account and data ownership, intellectual property, term and termination, offboarding, reporting and KPIs, confidentiality, a data processing agreement, and liability. The load-bearing clauses are ownership (you should own the accounts and data), the fee/ad-spend separation, and fair exit terms.

Who owns my Google Ads account under an agency contract?

You should. The contract should state that you own the ad accounts, data and audiences, with the agency having revocable access through its manager account (MCC). Access is not ownership — if the account sits on the agency's billing, you can lose the history and data when you leave, so client-owned-and-linked is the structure to require.

Who pays for ad spend — the agency or the client?

Ad spend is the client's cost, paid to the platform (Google, Meta), and it should never be treated as the agency's revenue. The contract should separate the management fee (the agency's revenue) from ad spend as distinct line items, and ideally you pay the platforms directly on your own billing profile so the spend and its history stay yours.

What is a normal notice period in a marketing agency contract?

Around 30 days is fair and standard. Notice periods of 60–90 days are steep and worth questioning, and anything longer starts to function as a lock-in. Pair the notice period with a defined offboarding SLA so access and assets are returned quickly after termination, not "when convenient."

What is the auto-renewal trap?

Auto-renewal silently renews the contract for another full term unless you give notice within a narrow window before the renewal date. The trap is a long term combined with a long notice period and a narrow renewal window, which re-locks you by default if you miss it. Require a transparent renewal clause with a clear window, and diarise it when you sign.

Do I own the creative and content the agency produces?

You should — the clean standard is that intellectual property assigns to the client on payment, including source files, so once you have paid for creative it is yours to use and edit. Watch for clauses where the agency retains ownership or grants only a licence, which can stop you using your own creative after you leave.

Do I need a DPA with my marketing agency?

Usually yes, where the agency processes personal data on your behalf (customer lists, lead data, audiences) under GDPR or UK GDPR. A Data Processing Agreement defines the agency as processor and you as controller. An NDA is not a substitute. Some activities can make the agency a joint controller rather than a processor, which changes the paperwork required.

Can a marketing agency guarantee results in the contract?

A credible agency commits to activities, effort and defined deliverables — not to guaranteed outcomes like a specific ranking, lead volume or ROAS, because the variables are not fully in its control. A contract guaranteeing a specific result is a red flag; what to require instead is transparent reporting and KPIs framed as targets with a clear attribution method.

Key takeaways

• A marketing agency contract must make ownership, the fee/ad-spend separation, and the exit unambiguous.
• You should own the accounts, data, pixels and audiences; the agency has revocable access.
• Keep the management fee and ad spend as separate line items; spend is your cost, not agency revenue.
• Require ~30-day notice, a defined offboarding SLA, IP assigning on payment, and a DPA where needed.
• Strike guaranteed results, blended spend, long locks, silent auto-renewal and agency-owned accounts.

Sources and further reading

• Google Ads Help — About manager accounts (MCC)
• Meta Business Help — Business Manager and asset ownership
• ICO (UK) — Contracts and liabilities between controllers and processors
• EUR-Lex — GDPR Article 28
• European Commission — Controller–processor standard clauses 2021/915

Continue learning

• Who owns your Google Ads, Meta and GA4 when you leave an agency?
• SEO contract: what to look for, the red flags, and why 'no lock-in' matters
• Marketing retainer vs project vs performance: how agencies bill
• Is your marketing agency a data controller or a processor?
• Questions to ask a marketing agency before you hire
• Performance marketing, run on client-owned accounts