Three Google Ads Changes Agencies Should Audit Before August 17
If you manage Google Ads for clients, I’d block some time this week for an account audit.
There are three things happening right now that deserve attention. One can directly change campaign efficiency starting August 17. Another gives Google permission to add its own creative assets to location-based ads. And the third is a security issue that could put an entire Manager Account at risk.
The first one has a deadline, so let’s start there.
1. Check Your Budget-Limited tCPA and tROAS Campaigns Before August 17
Starting August 17, 2026, Google is changing how target-based Smart Bidding behaves when a campaign is limited by budget.
The important part is this:
If a campaign has historically performed significantly better than the target you gave Google, Google may begin delivering closer to that target.
Google gives a very simple example.
If your tCPA is $10, but the campaign has actually been producing conversions at $5, the system may start moving performance closer to the $10 CPA you told it you were willing to accept.
That means some agencies could see CPA increase and assume something suddenly broke.
Nothing necessarily broke.
Google may simply be doing a better job of hitting the target you entered.
First, figure out which campaigns are actually affected
You only need to investigate campaigns that meet BOTH conditions:
If neither applies, leave it alone.
For the campaigns that do qualify, look at enough data to avoid reacting to noise.
I’d use whichever gives you the longest meaningful window:
Then compare your actual performance against the bidding target.
Here’s the decision I’d make
If actual CPA is above the tCPA, there’s nothing special to fix because of this update.
If the campaign is roughly on target, also leave it alone.
The campaigns worth examining are the ones dramatically outperforming the target.
tCPA: Actual CPA is less than about 80% of target CPA
tROAS: Actual ROAS is more than about 120% of target ROAS
And this is where the PPC metric alone is not enough.
You need to compare performance against the client’s real business target.
If a client can profitably acquire a lead at $100 and your campaign is generating them at $55 against a $90 tCPA, you have room to decide whether you want more volume.
Maybe increasing budget makes sense.
But if $55 is already close to the true CPA the business needs, leaving a $90 target sitting there could become a problem after August 17.
In that situation, consider moving the bid target closer to recent actual performance.
I would not necessarily slam the target all the way down to the current CPA in one move. Leave some room so you don’t choke spend and volume.
And for Search campaigns, this is a perfect use case for an experiment.
Change only the bidding target in the treatment campaign. That gives you a cleaner way to separate the effect of your change from the effect of Google’s August 17 update.
Google has confirmed that limited-by-budget campaigns that have historically beaten their stated targets may move closer to those targets after the change. Google is also explicitly encouraging advertisers to review those campaigns before August 17.
Do this now, not two weeks afterward when everyone is trying to figure out why CPA moved.
2. Check the Google-Owned Rich Media Setting
Here’s a setting I suspect a lot of agencies haven’t looked at.
Google can use its own library of rich media in campaigns associated with a client’s business locations.
This is separate from simply uploading your own creative.
Google says these assets can be incorporated into campaigns when they are available for linked business locations.
For some clients, that may be perfectly fine.
For others, especially legal, medical, franchise, regulated, or brand-sensitive accounts, I wouldn’t want third-party creative appearing without someone on the agency side consciously approving that decision.
Tools > Shared Library > Location Manager > Settings > Google-owned rich media</strong
From there, you can opt out.
And I would check this at the individual client-account level.
The important operational lesson here is that agencies can’t assume their normal automated asset settings cover every new form of Google automation.
Google keeps creating new places where automation can make decisions for advertisers.
Our SOPs need to keep evolving with it.
3. Treat Your MCC Like the Keys to Every Client Account
This one has nothing to do with optimization, but the downside is much bigger.
Agencies continue to be targeted with phishing attacks designed to get access to Google Ads Manager Accounts.
Once someone gets into the MCC, the blast radius can be enormous.
We’ve talked about this before, but it’s worth repeating because security shouldn’t be a one-time cleanup project.
It needs to become part of normal agency operations.
Your MCC security checklist
Require 2-Step Verification for every user.
Google allows Manager Account admins to enforce 2-Step Verification across the manager account and accounts it owns.
Passkeys are far more resistant to phishing because there isn’t a traditional password that can simply be copied from a fake login form.
Restrict access to approved email domains.
Google Ads Manager Accounts support an Allowed Domains setting. If your employees should only be accessing the MCC through your agency domain, enforce it.
That can stop someone from casually adding an unauthorized Gmail address to the manager account.
Send linking requests from your own MCC whenever possible.
Google lets you initiate account-link requests directly from your Manager Account using the client’s Customer ID.
Operationally, I prefer that process over clicking unexpected account invitations arriving through email.
Be extremely suspicious of Google Ads login links in email.
Modern phishing pages can look almost identical to the actual Google login screen.
The URL is often the giveaway.
Your PPC team shouldn’t be trained only on campaigns, bids, keywords, and conversion tracking anymore.
Account security is now part of PPC operations.
What I’d Have the Team Do This Week
Go through your client portfolio and create three checks:
Bidding audit:
Identify every limited-by-budget campaign using tCPA or tROAS and compare the target against actual performance before August 17.
Asset audit:
Review Google-owned rich media settings for every location-based client and decide whether Google should have permission to add its own creative.
Security audit:
Verify 2FA, passkeys, Allowed Domains, active MCC users, and your account-linking process.
And if your agency is already working with InvisiblePPC, there’s an important distinction here.
You do not need to worry about the bidding audit or the asset audit for the Google Ads accounts we manage. We’ve got those covered.
What you should still review on your side is the security audit, because access to your agency’s Manager Account, user permissions, login practices, and internal security policies ultimately sit with your agency.
So for existing InvisiblePPC partners, your action item is much simpler:
Focus on MCC security. We’ll handle the campaign-side bidding and asset checks.
None of these tasks is particularly complicated.
The risk comes from not knowing the settings exist until performance changes, the wrong creative appears, or someone gets access to an account they shouldn’t have.
And with Google Ads becoming more automated every year, this kind of operational account maintenance is becoming just as important as campaign optimization itself.
This Is the Stuff Agencies Shouldn’t Have to Discover the Hard Way
At InvisiblePPC, we manage Google Ads behind the scenes for agencies, including the campaign management, optimization, landing pages, reporting, and operational processes that come with managing client accounts at scale.
Part of doing this well is staying ahead of platform changes before they turn into client-facing problems.
If you’re already an InvisiblePPC partner, we’re handling the bidding and asset-side changes for the accounts we manage. Your job is to make sure your own MCC security is locked down.
And if you’re not working with us yet, this is exactly the kind of ongoing operational work that comes with managing PPC in-house.
If your agency wants to sell PPC without building and constantly retraining an entire in-house fulfillment operation, that’s exactly what our white-label team is built for.
