The Sandton Scenario: A ROAS Drop, a Former Contractor, and a 2am Budget Rule
A Sandton-based e-commerce brand sees ROAS tumble from 4.2 to 2.8 over a weekend. The team blames creative fatigue. Then someone notices a campaign budget was doubled at 02:13 on Saturday - by an account that still carried a former contractor's email. The contractor had been offboarded from payroll three months earlier, but nobody revoked their Google Ads access. This is not a login problem; it is a change-integrity problem. The same pattern repeats across South African marketing teams: a GA4 configuration change, a GTM tag paused, or a budget rule altered without a record of who did it. Monitoring Google account activity is how you rebuild that record.
Warning: Monitoring logs can themselves contain personal information. Under POPIA, define a lawful purpose, tell staff what is logged, and set a retention limit. This article is not legal advice; consult counsel before implementing monitoring.
What 'Google Account Activity Monitoring' Actually Means Across the Three Accounts in Play
The phrase is overloaded. In South African ad teams it usually refers to one of three distinct surfaces, each answering a different question:
- Personal activity (My Activity): What a signed-in user did across Google services - searches, YouTube views, location history, ad personalisation. It is a consumer privacy dashboard, not an audit trail for business changes.
- Security and Workspace logs: Login events, admin actions, Drive changes, and the Security Investigation Tool. This answers “who accessed what, from where, and when” at the identity layer.
- Marketing change forensics: Google Ads Change history, GA4 Change history, and GTM Version history. This answers “what changed in the campaign or measurement setup, by which user, at what time.”
The Sandton scenario lives in the third category, but you need the second to prove who the user was, and the first only if you are investigating a personal account’s broader activity. The table below compares the surfaces.
| Surface | What it records | Who can see it | Retention | Best for |
|---|---|---|---|---|
| My Activity | Personal searches, YouTube, location, ad personalisation | The signed-in user (and admins only via investigation tools on some editions) | User-set auto-delete (3, 18, or 36 months) | Privacy hygiene, not campaign forensics |
| Workspace Admin log events | Admin actions, login events, Drive log events | Workspace super admins and delegated admins | Edition- and setting-dependent; check your Admin console | Identity and access investigations |
| Google Ads Change history | Budget, bid, targeting, status changes with user and timestamp | Anyone with Ads account access | Rolling window; verify in-product for current length | Attribution of performance shifts to specific edits |
| GA4 Change history | Admin edits to properties, data streams, key events | GA4 admins and editors | Limited; export or screenshot for long-term records | Measurement configuration audits |
| GTM Version history | Container versions, tags, triggers, variables, workspaces | GTM account users with publish rights | Version history retained until deleted; workspaces are temporary | Tracking pipeline forensics |
The Personal Trail: My Activity and Activity Controls Explained Without Fear-Mongering
My Activity is where a user reviews and deletes their own Google service history. Activity Controls let them pause Web & App Activity, Location History, YouTube History, and Ad Personalisation, and set auto-delete at 3, 18, or 36 months. For a South African marketing team, this is relevant in two narrow cases: (1) a staff member uses a personal Gmail for work and you need to understand what data exists, and (2) an investigation requires the user to export their own activity. It is not a substitute for business-grade logging. Do not ask employees to hand over personal account credentials; instead, move work to Workspace accounts where admin logs apply.
The Workspace Trail: Admin Log Events, Login Events and the Security Investigation Tool
If your team uses Google Workspace, the Admin console under Reports > Audit and investigation is the identity backbone. Admin log events show who granted Ads access, changed a group, or altered an organisational unit. Login events show authentication attempts and suspicious sign-ins. The Security Investigation Tool (available on premium editions) lets you query these logs across users and time ranges. Use it to answer: did the former contractor’s account log in after offboarding, and from which IP range? Pair this with the Google Account “Recent security activity” page for individual users. This is the evidence layer that makes the marketing trail credible.
The Marketing Trail: Google Ads Change History, GA4 Change History and GTM Version History
Google Ads Change history (Tools & settings > Change history) logs budget, bid strategy, targeting, status, and rule changes with the user and timestamp. GA4 Admin > Change history records property and data-stream edits. GTM Version history records every container publish and the workspace it came from. Together they form the marketing forensic trail. The Sandton scenario is solved in minutes: filter Change history to the weekend, see the 02:13 budget change and the user email, cross-check Workspace login events for that user, then revoke access via the Managers screen.
Tip: Before concluding that the algorithm caused a ROAS drop, reconcile Ads Change history against GA4 config edits and server-side event health. A paused GTM tag can look like a bidding failure but is actually a measurement gap.
Set up Google Ads email alerts and automated rules for budget and bid changes above a threshold - for example, alert when a campaign budget increases by more than 20% in a day. This is not proprietary technology; it is native configuration that gives you a daily signal.
A Monitoring Cadence: Daily Alerts, Weekly Access Review, Monthly Attribution Reconciliation
Systemised growth beats growth hacks. Build a cadence:
- Daily: Automated rules and email alerts for budget, bid, and status changes. Check the Ads Change history digest.
- Weekly: Review the Google Ads Managers screen for active users and access levels. In Workspace, review group membership and OU changes. Confirm no dormant contractor accounts retain access.
- Monthly: Reconcile Ads Change history with GA4 Change history and GTM Version history. Map anomalies to attribution accuracy and MER (marketing efficiency ratio). If MER moved but platform ROAS did not, suspect a measurement change, not a media change.
This cadence ties directly to Prebo Digital’s emphasis on attribution accuracy over platform-reported conversions and clean data pipelines. See our custom reporting approach for how we structure these reconciliations.
POPIA and Monitoring in South Africa: Purpose, Transparency, Retention and Consult-Before-You-Act
POPIA applies to employee monitoring records because they can identify individuals. Four practical steps: (1) define a specific purpose - security, attribution integrity, or fraud prevention; (2) be transparent - include monitoring in your employee privacy notice and internal policy; (3) set retention limits - export logs only as long as needed, then delete; (4) restrict access - only named investigators should query Workspace logs. The Information Regulator’s guidance is the starting point, but this is not legal advice. Consult your counsel before rolling out monitoring across a team.
Outcomes You Can Measure: Attribution Accuracy, MER and Fewer Lost-Access Incidents
Track three outcomes: (1) attribution accuracy - the variance between platform-reported conversions and your reconciled source of truth after a change event; (2) MER - total revenue divided by total marketing spend, reviewed monthly alongside the change log; (3) access hygiene - the number of dormant or over-privileged accounts removed per quarter. These are operational metrics you can baseline and improve. For a structured review of your Google Ads account and access model, explore our Google Ads management and strategy consulting services. The goal is not surveillance - it is a reliable record that lets you trust your numbers and protect your budget.
