Google Search Console and Bing Webmaster Tools: Governing Access to Your Data 

Saying we need to pay attention to who can access our organic performance data and all the other information offered by Google Search Console and Bing Webmaster Tools might sound trivial, if not obvious. 

In reality, however, the phenomenon of uncontrolled access to performance or diagnostic data occurs far more frequently than one might expect — aided by a not entirely intuitive mechanism triggered when Bing Webmaster Tools is synchronised with Google Search Console. 

I have been doing agency-side SEO for over a quarter of a century, and in my experience the issue of Google Search Console access privileges granted for pre-sale activities or for the execution of a consulting contract — and then never revoked once the pitch ended or the engagement closed — is an absolutely common occurrence that has been happening, effectively, forever.  

This is particularly true for access to insecure http versions of websites, which on Google Search Console no longer contain any data and which, as a result, may be considered “harmless” and not worthy of particular attention. It has now been 12 years since Google announced the importance of the secure protocol as a “light” ranking factor, and the mass transition was completed over the course of a few years — not least because in 2018 Chrome began flagging all sites as “not secure”, regardless of their content and of whether or not they collected personal data or credit card information.  

It was with some surprise that I came to realise a rather counterintuitive behaviour — especially for a former aspiring lawyer turned digital marketer: by synchronising Bing Webmaster Tools with Google Search Console, you gain access to all versions of the domain, even if in GSC you only have access privileges for the non-secure http version. 

A Latin maxim familiar to every lawyer reads: “Nemo plus iuris in alium transferre potest quam ipse habet”, that is, no one can transfer to others more rights than they themselves possess.  

I published a post on LinkedIn to gather the opinion of a respected professional like Glenn Gabe, also tagging John Mueller of Google and the Bing Search page: 

Glenn Gabe was the first to reply, followed by John Mueller, who in turn tagged Krishna Madhavan of Bing. Here are their responses: 

I tried to clarify that my concern was about data governance, but John Mueller’s reply was terse: it’s an agency problem. 

The Real Problem 

I am of course grateful for the answers I received, but to be honest I’m not entirely satisfied. The problem I was trying to flag is neither technical nor about agencies: it is a mechanism that can make it difficult for site owners to understand who, in practice, has access to their data in Bing Webmaster Tools.

Having free access to a former client’s Bing search and AI Performance data simply because they have forgotten — or are unaware — that we still have access to an http version of the site in GSC, a version that has not collected any data for years, means being able to draw on non-public data to structure or refine the SEO/GEO project of a competitor or, at best, to back a win-back proposal with solid figures. This isn’t science fiction: it’s a concrete and very real possibility.

What to Do 

In my modest opinion, the Bing Webmaster Tools data-sync mechanism should only automatically import the domains for which access privileges are held in GSC at the https level. That would eliminate the issue entirely. 

To brands, on the other hand, I suggest asking their IT team or their digital consultants to carry out an audit of users across all instances of their domains in Google Search Console, so that they can clean things up and ensure full governance of access to confidential data.