What is actually shared when you connect GA4 or ads

Oct 2, 2026Product15 min

When you try a marketing tool, the first thing you usually see is a button for “Connect with Google” or “Connect with Facebook.”

I think a lot of people press it without knowing what gets handed to the other side. An ads account has a budget in it, and GA4 has numbers close to revenue. Hesitating is natural.

This article draws what is happening behind the connect button, and explains where on the consent screen you can tell “is this read-only, or can it also make changes?” You can use it for any tool you connect.

In the second half, the connections in Shoryaku AI ( https://shoryaku.net ), a marketing-support SaaS, are drawn in the same form: where it reads from, and what it might write.

What is happening behind the connect button

Almost all Google and Meta connections run on a mechanism called OAuth. The flow is this.

You
  │ ① Press "Connect" in the tool
  ▼
The Google / Meta screen
  │ ② Sign in and press "Allow"
  │    The password is entered here
  ▼
Google / Meta
  │ ③ Only the range you allowed can be used
  │    A spare key is passed to the tool
  ▼
The tool
  │ ④ With the spare key, it reads data
  │    in the range that was allowed
  ▼
Data such as GA4 and Google Ads

Three things are worth keeping.

First, the password is not passed to the tool. You enter it on the Google or Meta screen, and what the tool receives is only the spare key from step ③ (an access token).

Second, the spare key has a “range it can be used for” written on it. In OAuth this range is called a scope. The tool can use only the range it applied for at the start, such as “read GA4 only” or “manage Google Ads.”

Third, the spare key can be invalidated later. Even if you cancel the tool, the spare key is sometimes not deleted automatically, so when you stop using it you disconnect it yourself (how is below).

Almost all of the safety of a connection is written on the consent screen in step ②. Look at two points: “what,” and “how far.”

Example of how the consent screen is worded	Meaning
“See data for …” / “View …”	Read only. The tool cannot change settings
“Manage …” / “View, edit, create, and delete”	Changes are also possible. For ads, this is permission that can pause or change bids
“See your email address” / “See your personal information”	Used to confirm who the person who signed in is

If it says “manage,” it is permission that can also make changes. On top of that, check these two in the tool’s own explanation.

Who carries out a change. Does the user press a button every time, or does the tool run it automatically?
Can the change be undone. Is there a history of what changed, and can you revert from there?

Google Ads alone has no “read only” permission

This is the part that is confusing if you do not know it.

GA4 and Search Console have a “read only” permission. The Google Ads API does not have a read-only permission. Even a tool that only reads numbers shows a permission on the consent screen that corresponds to “manage Google Ads.”

So “manage” on the Google Ads consent screen does not, by itself, mean the tool is dangerous. What you can use to judge is whether that tool actually has a feature that makes changes, and the “who runs it” and “can it be undone” above.

How to disconnect a connection you no longer use

The default is to “disconnect” on the tool’s screen. If you can no longer sign in to the tool, or if you want to cut it off at the source to be sure, you can also remove it from the Google or Meta side.

For Google
  Google Account
  → Security
  → Third-party apps
     and services
  → Select the tool
     and "Remove access"

For Meta (Facebook and Instagram)
  Facebook Settings and privacy
  → Settings
  → Business integrations
     (or Apps and websites)
  → Select the tool and remove it

If you remove it on this side, the spare key the tool holds stops working immediately. The tool’s screen should show something like “reconnection required.”

Once every six months is enough. Look through this list. A tool you only tried, and do not use, is usually still there.

The whole picture of Shoryaku AI’s connections

From here, this is about Shoryaku AI. There are five things you can connect, and all of them use the same OAuth as the diagram above. There is no place where you type an account ID or an API key by hand.

Where it reads
  ├ Google Analytics (GA4)
  ├ Google Search Console
  ├ Google Ads
  ├ Meta ads
  └ Instagram
      │
      ▼
Shoryaku AI
      │
      ▼
Where it is used
  ├ Actions that raise revenue
  ├ Answers in AI chat
  ├ The monthly review
  └ MCP (looked up from an AI tool on your machine)

The permission applied for, and what is read, are as follows.

Connection	Permission	What is read
GA4	Read only	Visit counts, traffic source, landing page, key events
Search Console	Read only	Clicks and rank by search query and by page
Google Ads	Manage	Results from the campaign down to the ad
Meta ads	Read only	Results from the campaign down to the ad
Instagram	Read	Follower count, response per post

Google Ads is “manage” because, as written above, there is no read-only permission. What is read from GA4 is aggregated numbers. Data at the level of an individual, such as “who visited when,” is not collected.

For Search Console, only the read-only permission among those Google provides is applied for. Meta ads also do not apply for permission to manage ads. Only ads_read is applied for.

Pick the account to analyze one at a time

It is common for one Google account to see several GA4 properties or ads accounts.

Your Google account
  ├ GA4 property A (the one being analyzed)
  ├ GA4 property B
  └ GA4 property C

What is used for analysis is only the one you selected for that connection. Right after you connect, the first item in the list is selected, so if it is the wrong one, choose again on the external-connections screen. Ads accounts are the same. When you choose, the contents are checked again with the spare key at that moment, and then the switch is made.

When it goes to read

Shoryaku AI is not built to keep copying the connected data all the time. It goes to read when an action is created (or rebuilt).

What it reads then is the last 30 days, and the 30 days before that. The two periods are lined up to see what rose and what fell.

AI chat answers mainly from the numbers read at that time. Only when you ask in chat to change Google Ads does it go and read Google Ads on the spot, in order to find the keyword or ad in question.

The only place that writes is Google Ads

Nothing is written to GA4, Search Console, Meta ads, or Instagram. The permissions applied for are ones that cannot write in the first place.

Google Ads alone can have its settings changed, and only when you press the apply button. What can be changed includes pausing, resuming, or adding a keyword, adding a negative keyword, adjusting a keyword bid, replacing ad text, and setting locations or a schedule for delivery.

The flow is this.

① Shoryaku AI produces a candidate change
   On the actions screen, or in chat,
   you ask "stop this keyword"
      │
      ▼
② You check before and after on screen
   You can also validate without running it
      │
      ▼
③ You press "Apply"
   If you have not signed in within 5 minutes,
   you are asked to sign in again
      │
      ▼
④ Just before that, the target's current state is fetched again
   If it was already changed in the admin screen,
   it is not applied
      │
      ▼
⑤ What was applied is kept in the history
   It can be undone from the history with "Revert"

Shoryaku AI does not change ads on its own judgment. The candidate in ① is a proposal, and nothing happens in Google Ads unless you press ③.

④ is a mechanism so a change is not made twice. It is ordinary, between the proposal and the apply, for the same keyword to have been paused in the admin screen. Sending it as it is would be an unintended change, so the state is checked again just before apply. If the connection drops partway, it is not resent blindly. Whether it was already applied is checked, and then a decision is made.

An operation that, by Google Ads’ specification, can only be “delete and create again,” and cannot be reverted, such as changing the match type, is not handled at all.

How the spare key is handled

The spare key that was received (the token) is stored in a place only the server can read, separate from the connection information. What is returned to the screen is only a state such as “connected” or “reconnection required.” The spare key itself is never sent to the browser.

Connection information (also shown on screen)
  ├ Connection
  ├ State (connected, and so on)
  └ Account being analyzed

Where the spare key is kept (only the server can read it)
  ├ Access token
  └ Token used to refresh

Google’s spare key has a short expiry, so it is refreshed automatically when the expiry gets close. Only when it cannot be refreshed (for example, access was removed on the Google account side) does the screen say “reconnection required.”

At that point, something a user’s reconnection will fix, and a problem in Shoryaku AI’s own settings, are treated as different things. That is so a problem on this side does not make the user press reconnect over and over.

Meta’s spare key has an expiry that Meta sets, and when the expiry arrives a message asks you to reconnect.

What happens when you disconnect

When you disconnect on the external-connections screen, the following happens.

Press "Disconnect"
  ├ The stored spare key is deleted
  ├ The analysis account that was selected is removed
  └ The ads-account connection settings are deleted

After you disconnect, that connection’s data cannot be read. The spare key is no longer there. To use it again, you connect from the start.

If you remove Shoryaku AI from Facebook settings, a notice comes from Meta, and the connection on the Shoryaku AI side is disconnected automatically too. If you remove access on the Google account side, the spare key stops working, so the screen says “reconnection required.”

What to check before you connect

Only the five above are supported. Yahoo! ads, TikTok, LINE, and similar services cannot be connected. If you have a CSV, you can look at sales data in the CSV sales diagnosis, which does not require signup
The Google Ads consent screen shows a “manage” permission. As written above, that is the Google Ads API’s specification, and a change happens only when you press the apply button
Drilling into ads in AI chat down to the keyword or ad-set level is the Pro plan. Analysis at the account and campaign level can be used on every plan

Producing this week’s actions from the connected numbers, with the basis, the steps, and the target numbers attached, is the core of Shoryaku AI ( how it works ). How it compares with other tools is in Ways to see Google Ads, Meta Ads, and GA4 in one place, and how to read the same data from an AI tool on your machine is in How to get started with MCP.

The 14-day free trial does not ask for a card at the start. A connection can be added or removed later, so connect only one of GA4 or Search Console first, and see what comes out.