On August 6, 2026, Google published a help document confirming it is piloting a rule that blocks anyone signed in with a free email domain — @gmail.com, @yahoo.com and the like — from completing sensitive actions in Google Ads. Search Engine Roundtable’s Barry Schwartz and Search Engine Land’s Anu Adegbola both reported it the same day, and Google’s own language is that the requirement is “currently being piloted for a subset of advertisers,” with an email notification sent to each account as it is enrolled.
For a Warren machine shop or a Livonia dental group whose ad account has run on the owner’s personal Gmail since 2017, that is not a footnote. It is a live risk of being unable to add your agency, relink Merchant Center, or transfer admin rights during your heaviest spend window of the year.
What is the Google Ads corporate email requirement?
It is a pilot rule tying high-risk account administration to a Google Account on a private business domain. Free-domain users keep day-to-day access — reports and routine campaign edits — but attempting a sensitive action triggers an in-app prompt to switch to an authorized corporate email domain first.
The mechanism matters more than the headline. Google is not disabling accounts or forcing migrations. It is drawing a line down the middle of the permissions model — campaign work on one side, account governance on the other — with the credential you signed in with, not the access level you were granted, deciding which side you land on. An account whose only admin is a Gmail address therefore has full editing power and zero administrative power the moment the pilot switches on.
Which actions count as “sensitive,” and which still work on a Gmail login?
Google names two examples: account linking updates and user access changes. Everything else is deliberately unstated — the help doc says the list is “non-exhaustive and subject to change without prior notice.”
- Confirmed gated: inviting or removing users, changing access levels, and adding or editing account links — Merchant Center, GA4, YouTube channels, conversion imports.
- Still open on a free domain: viewing reports and making routine campaign edits.
- Unstated, and the part to plan around: billing profile changes, manager account link requests, API access. Assume anything touching money or data access is a candidate.
A rule whose scope can grow without notice is a rule you cannot schedule around. Fix your login before you are told to.
Why is Google doing this now?
Google’s stated reason is to “enhance account security and minimize the impact of unauthorized access.” Schwartz ties it to the wave of Google Ads account hijacks the industry has been reporting, and it fits a pattern: PPC Land reported that Google began requiring passkeys for sensitive actions from July 15, 2026, and Search Engine Land noted on August 6 that Google launched a secure API access pilot for manager accounts. Three controls, one attack — someone takes over a login, adds themselves as admin, attaches a payment profile, and spends your budget on their offer.
Corporate domains help because they are revocable at the domain level. Compromise a personal Gmail and Google’s only lever is that account. Compromise you@yourcompany.com and your own admin kills the session in minutes.
How does the Multi-Party Approval deadlock happen?
Google’s FAQ confirms that if an account has three or more active administrators, inviting a new user or modifying admin privileges triggers Multi-Party Approval — a second existing admin must approve the request.
Stack that against the email rule. A Rochester Hills HVAC company has four admins: the owner’s Gmail, a former coordinator’s Gmail nobody deactivated, an old agency’s Gmail, and one corporate address belonging to a controller who left in March. The account enrolls. Adding a proper corporate admin is a sensitive action, so it must come from a corporate login — and the only corporate login is a departed employee’s. With four admins, it also needs MPA approval. You now need a corporate credential to escape a state you cannot escape without one.
Test any account with one question: if every Gmail admin lost administrative power tonight, is there still a reachable corporate-domain admin who can act? If not, you are one enrollment email away from a support ticket instead of a settings change.
Does this actually make small advertisers safer?
Partly, and the gap is what Google is quietest about. Requiring a corporate domain raises the cost of a takeover but does not detect one. An attacker who phishes a Workspace account arrives holding exactly the credential the policy is built to trust — it is the passkey requirement, not the email domain, that blunts phishing. The domain rule is accountability plumbing more than defense.
What it unambiguously does is shift remediation cost onto the smallest advertisers. A company with an IT department already complies and will never notice. A four-person landscaping outfit in Sterling Heights running a few thousand a month on the owner’s Gmail must stand up a business email identity, migrate a login, register a passkey, and re-verify links — all to keep a permission it already had.
Why does this hit Michigan advertisers harder?
Two structural features of the regional economy. First, the density of family-owned suppliers, machine shops, and trades businesses across Warren, Sterling Heights, and Livonia. These firms usually do have company email — but the ad account predates it, opened on whichever personal address the founder or a nephew happened to use. Nothing ever forced the two identities to reconcile.
Second, agency churn among multi-location service businesses. An HVAC group with six metro locations, or a dental practice spanning Royal Oak and Troy, has cycled through three or four vendors, each leaving an admin behind. Those orphaned Gmail admins are what push an account past the three-administrator MPA threshold — which is why the cleanup step below matters more than the migration step.
Timing is the sharp end. Michigan furnace-replacement demand climbs from September until the first hard freeze. Discovering in October that you cannot grant a new agency access is not a lost settings change; it is lost reaction time during the ten weeks that pay for the other forty-two. Access hygiene is a standing item in every Google Ads account audit we run.
How should a small team fix this in one week?
- Inventory admins today. Google Ads → Admin → Access and security. List every Admin-level user and their email domain. Count how many are free-domain, and how many still work with you.
- Remove orphaned admins before adding anyone. Dropping below three active administrators avoids the MPA trigger entirely. Do this first, while a Gmail admin can still act.
- Stand up two corporate-domain Google Accounts. Two, not one. A single corporate admin is the same point of failure wearing a better domain.
- Grant Admin access and test it. Add and immediately remove a read-only user, so you learn the prompt behavior before you need it under pressure.
- Register a new passkey on each corporate login. Google’s FAQ is explicit that passkeys are tied to individual Google Accounts — your old Gmail passkey does not transfer.
- Turn on Allowed Email Domains. This existing Google Ads security setting restricts which domains can be invited at all — the durable fix that stops the next departing vendor from leaving a Gmail behind.
- Re-verify every link, then write down your two corporate admins. Confirm Merchant Center, GA4, and conversion imports are healthy while relinking is still easy. Nearly every failure case in this policy is “the person who could do this no longer works here.”
What dates belong on the calendar?
- Now through enrollment: the pilot is rolling to a subset of advertisers with no published end date. Your notice is an email — likely your only warning.
- August 17, 2026: Google’s target-based bid strategy change takes effect for budget-limited Search, Shopping, Performance Max, Demand Gen, and Travel campaigns; Ads Liaison Ginny Marvin posted a video Q&A August 6. It collides with the email rule — the standard response is to repair conversion tracking and revisit links, and relinking is the action class now gated.
- Passkey enforcement: PPC Land reported a July 15, 2026 start for sensitive actions, while some agency write-ups cite mid-August. Treat the exact date as unsettled and register passkeys now.
- September to November: Michigan heating and winter-services demand ramp. Finish access work before Labor Day, not during it.
Frequently asked questions
Is my Google Ads account already affected?
Only if Google enrolled it. The company says the requirement is being piloted for a subset of advertisers, and that enrolled accounts receive an email notification. There is no public opt-in or lookup tool. Because the criteria for inclusion have not been disclosed, the practical assumption is that any account can be enrolled at any time.
Can I keep using my Gmail login for daily campaign work?
Yes. Google confirms free-domain users can still view reports and make routine campaign edits according to their access level. The restriction applies only to sensitive actions such as user access changes and account linking updates. Even so, making a corporate login your primary avoids surprises whenever that list of sensitive actions expands.
Does my agency need a corporate email too?
If they perform administrative work on your account, yes — the rule keys off the signed-in credential, not the relationship. Any agency still logging in from a personal Gmail should be migrating now. It is a fair question to raise at your next review, and a useful signal about how they handle client account security in general.
What if I have no business email domain at all?
You need one. If you already own the domain your website runs on, adding email to it through a hosted business email provider is a same-day task and gives you the revocable identity this policy is built around. If you do not own a domain, register one first — the ad account will not be the last thing that depends on it.
The takeaway
Small change, ugly tail. The migration is an afternoon of work; the deadlock is a support queue during furnace season. Audit admins this week, get two corporate logins with passkeys, and enable Allowed Email Domains so the problem does not regrow. More in our Detroit search marketing updates.
Comments are closed