A working brief on digital marketing agencies red flags

What to take away

Digital marketing agencies red flags are not personality quirks. They are observable signs that claims, incentives, access, evidence, or accountability may be unsafe. One concern can often be resolved through documentation. Several unresolved concerns should stop or narrow the engagement; review the agency overview as part of your selection process.

Guarantees that skip the variables

An agency that guarantees rankings, revenue, or a fixed return is promising outcomes it does not control. It does not set your price, your inventory, your sales team, or your market. For example, a pitch that promises a fixed return without naming the baseline or assumptions is a red flag.

Ask for the metric, the baseline, the assumptions, the time window, and the exclusions. Then ask what happens if the number misses. A forecast that discloses uncertainty is worth more than a promise that does not.

Credentials you can check at the source

Platform partner status, certifications, and awards are verifiable. Check the issuing organization’s official source, such as the Google Partners directory, Microsoft Advertising Partner Program, Meta Business Partners directory, Amazon Ads Partner Directory, or HubSpot Solutions Directory, as applicable. Record what the credential covers, who holds it, and the date you checked; a proposal that says “certified partner” without a verifiable listing or named certificate holder is not enough.

Reviews that were never independent

Watch for repeated generic wording, sudden review bursts, undisclosed reviewer relationships, and pressure to remove criticism. For example, a set of testimonials with identical phrasing and no disclosed connection to the agency warrants verification. Paid placement presented as editorial is the same problem wearing a better suit. The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials is a relevant U.S. reference for fake or false reviews and certain review-related practices.

Ask how reviews are sourced, verified, displayed, corrected, and monetized. A structured review method keeps source evidence, review owners, and correction records together.

The team you never meet

Stop when sales leaders refuse access to the people who will do the work. For example, a proposal may name a strategist but describe execution only as a “shared pool”; ask for the actual delivery roster and allocation. The same applies when named staff are not committed, subcontracting is unclear, or you have no replacement rights.

Require the following in writing:

Access that lives on someone's personal login

Shared passwords, personal logins, and undisclosed manager accounts create operational and security risk. Verify ownership and named access in the actual workspaces, such as Google Ads, Meta Ads Manager, GA4, and LinkedIn Campaign Manager. If the agency cannot show which client-owned account holds the campaign history and who has access, resolve that before launch.

NIST Special Publication 800-161 Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022), covers risks from external service providers and controls for contractor access, least privilege, agreements, monitoring, and timely updates. Apply proportionate controls to client-owned accounts and named roles. Also apply them to authentication, logs, reviews, and offboarding.

Dashboards that hide the definitions

Question any dashboard that hides:

Attribution deserves its own question. Ask which model is running, what the conversion window is, and whether the platform counts view-through conversions. A mis-set window can make a channel look profitable when it is not.

Data and AI use you cannot describe

Do not grant broad access when the agency cannot identify systems or data. It must also identify purposes, subprocessors, retention, and deletion. It must identify incidents, transfers, or AI use. If the answer is vague—for example, the agency cannot say which tool receives customer data or when it is deleted—the answer is no.

For California-covered relationships, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), includes contract requirements for service-provider and contractor relationships. Ask counsel to confirm which privacy laws apply and ensure the written terms address permitted use, subprocessors, retention, deletion, and assistance with consumer requests.

The NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0, was published January 16, 2020. It explains how organizations communicate privacy requirements to external service providers and use profiles in data-processing relationships. It is voluntary risk guidance, not legal advice and not proof that a vendor meets its commitments. Read the framework.

Contracts built to hold you

Long terms are not automatically unfair. Unexplained auto-renewal, inaccessible assets, punitive exit fees, non-transferable accounts, and missing source files are serious. Missing transition duties matter just as much. For example, a contract that lets the agency retain admin access or withhold editable files after termination needs a clear ownership and handover remedy.

Before work begins, settle these items:

Decision table

Assign the practice

Use the NIST Privacy Framework starting guide to assign data and response owners, including who approves access, handles requests, and confirms deletion. Apply those responsibilities when reviewing marketing agency case studies for privacy practices. The framework is not legal clearance.

CISA and NSA’s Best Practices for Event Logging and Threat Detection (August 2024) explains how event records support security review. Preserve access, change, failure, and correction records without claiming that logging validates a metric.

Common questions

Is a guaranteed marketing result always a red flag?

It is risky when the promise ignores variables the agency cannot control, lacks a precise definition, hides assumptions, or offers no credible measurement and remedy. A guarantee tied to a named metric, a stated baseline, and a written remedy is a different thing.

Should an agency own the advertising accounts?

Use client-owned primary accounts where the platform permits, then grant named, role-based access for the work and remove it promptly at exit. Agency-owned accounts make your history, audiences, and conversion data a negotiating chip.

When should a buyer stop an agency selection?

Stop or narrow it when material gaps remain unresolved:

How do I check attribution before I sign?

Ask which model runs, what the conversion window is, and whether view-through conversions count. Then ask to see the raw platform data next to the dashboard. If the two disagree and nobody can explain why, treat the reporting as unverified.