Google Ads Governance: 3 Rule Changes, One Checklist

Google Ads account governance changed three times in a single news day. On July 14, 2026, Search Engine Roundtable reported that removing a user’s access now requires a written justification routed to a second administrator, that the alcohol policy expands to 29 more countries on July 28, and that gambling certification requirements broaden to every category under the policy on September 14.

Individually, each item is thin — a screenshot, a policy-page changelog entry, a one-paragraph trade-press blurb. That is exactly why they are easy to miss. But for agencies and in-house teams managing client or multi-brand accounts, the three land on the same operational surface: who can touch the account, what the account is allowed to advertise, and what paperwork Google now expects before either changes.

This post treats the bundle as one governance moment. We cover what the new access-removal gate does, the solo-admin gap it exposes (with a May precedent that suggests the gap is structural), the two policy deadlines with country-level detail, and a proprietary action table that maps who must act and by when — with a clear line between what Google has confirmed and what is only reported.

The clustering is not our framing trick — it is in the timestamps. Barry Schwartz, Executive Editor at Search Engine Roundtable, published the access-removal story at 7:41am ET on July 14, 2026, and the alcohol-and-gambling policy story at 7:51am ET the same morning. Ten minutes apart, same byline, three distinct changes to how Google Ads accounts are governed.

It also fits a broader pattern this month. Google’s July 2026 terms update already rewrote the contractual layer of the advertiser relationship; these three items rewrite the operational layer — permissions, market eligibility, and certification. Teams that treat each blurb as skippable news will meet all three as surprises. Teams that treat them as one checklist get ahead of two hard deadlines and one live behavior change.

The change was first spotted via a screenshot posted by PPC practitioner Arpan Banerjee on X, captioned “Google Ads now asks for a justification when removing account access for added security.” Search Engine Roundtable picked it up on July 14, 2026. The mechanics, as reported: when a user requests removal of another user’s access, Google Ads asks for a written justification, then routes the request to another administrator for approval — with the justification text included for the approver to read.

According to trade-press reporting of the interface — ppc.land’s reconstruction of the screenshots, not a Google-published spec — the dialog captures the name of the user losing access, the specific Ads account involved, that user’s current access level, and a free-text justification field, with interface copy noting the justification “will be seen by approvers.” The same reporting says removal requests expire after 20 days if no second administrator approves them. Treat that expiry window as reported, not confirmed: Google has published no official documentation for the feature as of this writing.

On its face, this is a sensible hardening move. Account takeovers frequently begin with an attacker quietly removing legitimate users — a two-person rule on removals closes that door, the same way our account-security audit checklist recommends dual control for payment and access changes. The problem is not the intent. The problem is who gets locked out.

Here is the failure mode: an approval gate that requires a second administrator assumes a second administrator exists. Vast numbers of small-business and single-owner Google Ads accounts have exactly one admin. Per ppc.land, neither the May nor the July screenshots show a fallback mechanism, appeals process, or emergency-access path for accounts with only one administrator.

And this is the second time the same gap has surfaced. On May 7, 2026, a PPC professional posting as @PPCGreg documented — per ppc.land’s account — a near-identical approval gate on access-level changes, such as upgrading a user from Read-only toward Admin, and asked the obvious question: what happens when you are the only admin on the account trying to add another admin? On July 14, he publicly linked the two incidents as evidence of a recurring gap in the permissions system. Two sightings in two separate corners of the permissions surface, two months apart, with the same missing fallback — that reads as an architectural oversight, not a glitch.

We would resist extending this into a grand “Google Ads permissions overhaul” narrative — two data points connected by one outlet’s editorial framing is not a roadmap. But you do not need a roadmap to act. You need a second admin.

The first hard deadline is Google-confirmed. On July 28, 2026, Google Ads updates its Alcohol policy to expand the approved geographic locations for the sale and informational promotion of alcoholic beverages. The policy page lists 29 additions: Botswana, Burundi, Brazil, Cameroon, Congo Brazzaville, Croatia, DR Congo, Ecuador, Eswatini, Ethiopia, Finland, Gabon, Iceland, Ivory Coast, Jamaica, Kenya, Lesotho, Mozambique, Namibia, Rwanda, Serbia, Seychelles, Sierra Leone, Slovenia, South Korea, Tanzania, Vietnam, Zambia, and Zimbabwe.

The nuance sits in three of those markets. Ecuador permits ads only for beverages under 5% ABV, Iceland under 2.25%, and Vietnam under 5.5%. In every newly added location, advertisers may promote beverages up to the region’s maximum permitted ABV, and 0% ABV beverages are permitted everywhere. Google’s compliance framing is unambiguous: ads must respect the specific ABV limits, adhere to all local laws, and never target minors.

For multi-market accounts, the practical work is a geo-targeting and creative review before July 28 — deciding which of the 29 markets are commercially relevant, splitting campaigns where an ABV ceiling forces different product sets, and confirming local-law requirements that Google’s policy explicitly leaves on the advertiser. A beer brand can now reach South Korea and Brazil with its full range; the same brand’s lineup needs filtering to under-2.25% (in practice, low- and non-alcoholic SKUs) before Iceland makes sense.

The second confirmed deadline has a longer runway and sharper teeth. On September 14, 2026, the Gambling and games policy expands the certification requirements Google launched in March 2026 to all categories under that policy. Keep the two dates straight: March introduced certification for a subset of gambling categories; September removes the subset qualifier. From September 14, all accounts seeking to advertise in any gambling and games category must demonstrate good policy health — and Google says the policy’s Certification section will be formally updated when the expanded requirements take effect.

The enforcement mechanism reaches above individual accounts. Manager Accounts with repeated online gambling certificate revocations — or accounts under MCC management repeatedly flagged for gambling violations while using a certificate — forfeit eligibility to apply for new online gambling certificates, and may have existing certifications revoked. For agencies, that inverts the usual risk model: one careless client account under your MCC can now poison certification eligibility for the whole book.

The domain requirements, reiterated alongside the update, are worth auditing too: websites hosted on free subdomains are ineligible for certification, the domain must be directly owned and controlled by the advertising business, and domains unrelated to gambling are ineligible — what Google terms standalone ineligibility. None of that is new, but from September 14 it applies to categories that never previously needed a certificate at all.

No single published source tabulates all four governance changes — the July removal gate, the May access-level precedent, and the two policy deadlines — with dates, affected parties, and required actions in one place. Each lives in a separate one-off blurb or help-doc changelog entry. So here is that table, with an explicit confirmed-versus-reported column so you can weight each row appropriately.

The runway math matters for prioritization. Counting from the July 14 announcements, alcohol advertisers had 14 days of notice before the July 28 effective date; gambling advertisers got 62 days to September 14. The access-removal gate offered zero days — it was already live in accounts when it was spotted.

Read together, the three changes point in one direction: Google is pushing formal change-management into Google Ads. A written justification reviewed by a second person is textbook two-person control — the pattern compliance frameworks have long required for production systems, now applied to ad-account permissions. The policy updates carry the same DNA: certification as a standing prerequisite rather than a one-time hurdle, and policy health as an account-level asset that an entire MCC can forfeit. The platform is starting to treat advertiser access the way regulated industries treat privileged access.

Projecting forward, the reasonable expectation is more of this, not less. The May and July sightings suggest approval gates are spreading across the permissions surface piece by piece, and the September gambling expansion shows Google is comfortable converting subset requirements into universal ones on a few months’ notice. If that trajectory holds, a solo-admin fallback will eventually be forced by support volume — but “eventually” is not a governance plan. Agencies that already run structured account audits — our 100-item Google Ads audit checklist is the template we use — should add a standing governance section: admin-roster review, certification status, and policy-deadline watch, refreshed quarterly.

There is also an automation angle. Admin rosters, certification states, and policy-effective dates are exactly the kind of structured, checkable facts that a paid-media ops agent can monitor on a schedule and flag for human review — read-only checks with a person making the changes, which happens to be the same two-person pattern Google is now enforcing natively. If you would rather hand the whole governance layer to a team that does this daily, our paid media management service runs these audits as part of standard account operations.