Your Ad Account Has a Leak. Here’s How to Find It in 10 Minutes.
Your Ad Account Has a Leak. Here’s How to Find It in 10 Minutes.
By Sarah Mitchell, Ph.D. in Artificial Intelligence
We like to think of our digital lives as private sanctuaries. We log in, we browse, we buy, and we log out. We assume that what happens inside our ad accounts—our customer lists, our creative assets, our conversion data—stays inside those accounts. We assume the walls are solid.
But in the world of digital advertising, walls are porous. And rarely are they broken by a dramatic hack with a headline in the tech news. More often, the leak is subtle. It’s a forgotten API token. It’s an ex-employee’s session cookie that never expired. It’s a third-party integration that has more permissions than it needs. It’s a creative asset uploaded three years ago that is still being served to a customer segment you’ve since deleted.
If you are a marketing manager, a growth lead, or a business owner who runs paid acquisition, you need to assume there is a leak in your ad account. Not because it’s a certainty, but because the architecture of modern ad platforms is a collection of open doors. Your job is to find them before someone else does—or before the leak quietly drains your budget, corrupts your data, or exposes your customer base.
This is not a chapter in a textbook on information security. This is a practical, ten-minute audit you can do right now. No tools required. No IT department needed. Just your ad account, a browser, and a willingness to look at what you haven’t looked at in a while.
Why Ad Accounts Leak: The Architecture of Trust
To understand where the leaks come from, you need to understand how ad platforms are built. Platforms like Meta, Google, TikTok, and LinkedIn are not monolithic systems. They are ecosystems of interconnected services. Your ad account is a hub that connects to:
The platform’s own servers, which store your pixel data, conversion events, and audience segments.
Your website’s analytics tools, which receive conversion data via server-side APIs or browser pixels.
Your CRM or email marketing platform, which syncs customer lists for custom audiences.
Your data warehouse or data lake, which ingests raw event data for modeling.
Third-party SaaS tools—attribution software, creative management platforms, social listening tools—each of which needs read or write access to your account.
Every one of these connections is a door. And every door has a key. And every key, if not managed carefully, can be copied, lost, or left in a position where someone else can use it.
In the world of software engineering, we call this the principle of least privilege. A user or a service should have only the permissions it needs to do its job. But in practice, most ad accounts operate on the principle of accumulated privilege. You grant a tool access for a project. The project ends. You don’t revoke the access because it’s one more click you don’t want to do. A new team member joins. You give them full admin access because it’s faster than setting up a specific role. Six months later, that person leaves. And that full admin access? It’s still there. Hanging on the door like a coat that nobody took off.
That’s a leak. Not a dramatic one. A quiet one. A door left open in a room you thought was private.
Minute 1–2: The Session and Cookie Audit
Open your ad account in a browser. Before you do anything else, open your browser’s developer tools (usually F12 or right-click and select “Inspect”). Go to the “Application” tab (Chrome) or “Storage” tab (Firefox). Look at the cookies and local storage.
You’re looking for things that don’t belong. If you’re on a shared computer, or if you’ve used a browser on a public device, there may be session tokens, authentication cookies, or cached data from other accounts or other people. If you’re on a personal laptop, you’re still looking for cookies from tools or services you’ve used in the past that shouldn’t have access to your ad account.
This is a small thing. But it’s the first layer of the wall. If someone can read your session cookie, they can log in as you. And in an ad account, that means they can see your budgets, your creative, your audiences, and your performance data.
If you find a cookie you don’t recognize, look it up. What service does it belong to? Do you use that service? If not, consider clearing it. If you do use it, check the permissions that service has in your ad account.
Minute 3–4: The Permission and Role Audit
Navigate to your ad account’s business settings or account settings. You’re looking for the list of people and roles.
Go through each person on the list. Ask yourself three questions for each one:
Do I still work with this person? If they left the company, do they still have access?
What role do they have? Do they have admin access when they only need analyst access?
What do they have access to? Can they see all ad accounts, or just the ones relevant to their role?
This is where you’ll find the first real leaks. The ex-employee with admin access. The contractor from a project two years ago who still has “full access” to the account. The intern who was given access for a summer and never had it removed.
You don’t need to remove all of them. But you should identify them and decide what to do. The ones who are still active, verify their role matches their current job. The ones who are no longer with you, consider removing their access. If they have admin access, that’s a priority.
This is not about paranoia. It’s about hygiene. You don’t leave the back door open in your house because you trust the neighbor. You close it. You check it. You make sure it’s locked.
Minute 5–6: The Integration and API Audit
Go to your ad account’s integrations or apps section. This is where you’ll see the list of third-party tools that have access to your ad account.
Look at each one. For each integration, you want to know:
What is the tool? If you see an integration you don’t recognize, look it up. What does it do? Why is it connected?
What permissions does it have? Can it read your data? Can it write to your account? Can it manage budgets? Can it upload creative?
When was it connected? If it was connected three years ago, ask yourself: do we still use this tool? Is the connection still active?
This is where the most interesting leaks hide. You’ll find tools you connected for a specific project that you’ve since abandoned. You’ll find analytics tools that were connected for a one-time data pull and were never removed. You’ll find social listening tools that have read access to your ad account and are quietly collecting data on your campaigns.
Each of these is a door. And each door is a potential leak. You don’t need to remove all of them. But you should know about all of them. And you should verify that each one is doing what you expect.
If you use a server-side API for conversion tracking, check the API token. Is it a production token or a test token? Does it have broader permissions than it needs? Can it access data beyond the conversions you’re tracking?
Minute 7–8: The Creative and Audience Audit
This is the layer most people skip. And it’s where some of the most subtle leaks live.
Go to your ad account’s creative library or ad set level. Look at your creative assets. Are there creatives you don’t recognize? Creatives that were uploaded by someone else? Creatives that reference a brand, a product, or a campaign that no longer exists?
These are clues. A creative uploaded by someone else means someone had access to your account and used it. A creative that references a discontinued product means the creative was made at a time when that product was current. A creative that uses a customer’s photo or a specific message means someone used your account to target a specific audience.
Now go to your audiences. Look at your custom audiences and saved audiences. Are there audiences you don’t recognize? Audiences that were created by someone else? Audiences that reference a customer list you don’t have?
These are the quiet leaks. They’re not dramatic. They don’t show up in a dashboard. But they mean someone has access to your account and is using it. And if they’re using it, they can see your data.
This is where you’ll find the ex-employee who is still running campaigns for their new company using your ad account. The contractor who is using your pixel data to build their own audience. The agency that is still accessing your account to “check in” on your campaigns.
You don’t need to find all of them. But you should know about the ones that are there. And you should decide what to do with them.
Minute 9–10: The Data Flow Audit
This is the final layer. And it’s the one that’s hardest to see.
Go to your ad account’s data manager or data source settings. You’re looking for the flow of data between your ad account and your other tools.
You want to see:
What data is flowing out? Conversions, impressions, clicks, customer lists, creative performance data.
Where is it going? Your data warehouse, your CRM, your analytics tool, your attribution platform.
How is it flowing? Browser pixel, server-side API, direct integration, manual export.
How much is flowing? Is it all your data? Or just the data relevant to the tool?
This is the layer that’s hardest to audit because it’s invisible. You don’t see the data flow. You see the results. You see the dashboards. You see the reports. But you don’t see the pipes.
And the pipes are where the leaks happen. A data flow that’s too broad means a tool is seeing more data than it needs. A data flow that’s missing means a tool isn’t getting the data it needs. A data flow that’s outdated means a tool is seeing stale data and making decisions based on it.
You don’t need to audit every data flow. But you should know about the major ones. And you should verify that each one is doing what you expect.
Putting It All Together
You’ve spent ten minutes. You’ve looked at your sessions, your permissions, your integrations, your creatives, your audiences, and your data flows. You’ve found the doors. You’ve checked the keys. You’ve verified the rooms.
You may have found five leaks. Or you may have found one. Or you may have found none.
If you found none, you’re in good shape. Your ad account is well-maintained. Your permissions are clean. Your integrations are current. Your data flows are tight.
If you found some, you’re in better shape than most people. Because you found them. And you can fix them.
And if you found a lot, you’re in the best shape of all. Because you found them before someone else did. And you can fix them before they become a problem.
This is not a one-time task. You should do this every quarter. Or every month, if your ad account is high-volume. Or every week, if your ad account is mission-critical.
But the point is not the frequency. The point is the habit. The habit of checking the doors. The habit of verifying the keys. The habit of looking at the rooms you haven’t looked at in a while.
Because in the world of digital advertising, the walls are porous. And the leaks are quiet. And the best way to find them is to go look.
Start today. Ten minutes. No tools needed. Just your ad account and your willingness to look at what you haven’t looked at in a while.
You’ll find the leak. And you’ll know where it is. And you’ll be able to fix it.
And that’s the point.
