Every SEO engagement ends. Most contracts never say who keeps what.
Some engagements end with a handshake and a referral.
Others end with a terse email, an unpaid invoice — and a client discovering they can’t log in to their own Google Search Console.
That’s usually the moment both parties finally read the contract. And discover it says nothing useful.
- It covers deliverables, fees, maybe a notice period. It says nothing about:
- Who owns the 200 articles published over three years.
- Whether the agency must hand over the redirect map from the site migration.
- What happens to backlinks the agency placed — and quietly pays to maintain.
- Who controls the analytics property holding five years of irreplaceable data.
If you can’t answer those questions about your own website today, here’s the uncomfortable truth:
- You don't own your SEO. You're renting it — and the lease terms are whatever your agency decides they are on the day you leave.
This is one of the least-written-about problems in SEO, and the reason is structural:
- lawyers don't understand SEO work product, and SEOs avoid writing about contract law.
Nobody writes the guide, so nobody reads it, so the same dispute replays every week in this industry — and the side that loses is almost always the one that assumed.
This guide sits in the gap — written as a neutral reference for both sides of the table.
We’ll use Malaysian law as the worked example throughout, for two reasons: its copyright framework produces a surprisingly different default than the U.S. or U.K., and the principles translate cleanly across most common law jurisdictions.
* Disclaimer: This is an industry guide, not legal advice. Real disputes turn on the specific contract, facts, and jurisdiction — engage a commercial lawyer when real money is at stake.
Why SEO Ownership Is Murkier Than Any Other Service
When a contractor finishes renovating your office, ownership is trivial — the walls are attached to your building.
SEO is the opposite. The work product is scattered across five different categories of property, each governed by a different legal regime:
5 Different Categories of Property
- Copyright works
Articles, page copy, graphics, and custom code. Who owns commissioned work varies dramatically by country.
- Platform accounts
Search Console, GA4, Google Business Profile. “Ownership” here is defined by Google’s terms, which care about who holds the admin role — not who paid the invoices.
- Backlinks
Backlinks live on domains neither party owns. You can’t repossess a link.
- Data
Ranking histories, analytics records, conversion data. Legally awkward everywhere, and personal data triggers privacy statutes.
- Know-how
The agency’s methodology, templates, and tooling. Protected (if at all) as confidential information, not copyright.
Because each category defaults differently, “who owns the SEO?” has no single answer. The only honest approach is asset by asset — which is how this guide proceeds.
What Happens When The Contract Is Silent
Most disputes exist precisely because the contract never assigned ownership. So everything starts with the legal default — and the defaults are wildly inconsistent across jurisdictions.
- United States
Agency Owns
An independent contractor (which is what an agency is) owns the copyright in what it creates — unless there’s a written “work made for hire” agreement or an express assignment.
A U.S. client who paid for 200 blog posts with no IP clause may own none of them. They hold, at best, an implied license to use them.
- United Kingdom
Agency Owns
Under the Copyright, Designs and Patents Act 1988, the author — or the author’s employer, i.e., the agency — is the first owner of copyright in commissioned work, absent a written assignment.
U.K. courts sometimes imply a license or beneficial ownership in the client’s favor. But the client has to fight for it.
- Malaysia
Client owns
Under section 26(2) of the Copyright Act 1987, where a work is commissioned by someone who isn’t the author’s employer, copyright is deemed transferred to the commissioner — subject to any agreement to the contrary.
In plain terms: if a Malaysian client commissions content and the contract says nothing about IP, the statutory default favors the client, not the agency. The reverse of the U.S. position.
Two qualifications:
- The deemed transfer covers commissioned works only — not the agency’s pre-existing materials, internal tools, or reusable frameworks.
- Contracts override the default. A clause retaining IP until payment in full is enforceable — and it’s the single most important clause either side can negotiate.
With that foundation, here’s the asset-by-asset breakdown.
Content: Articles, Page Copy & Creatives
The client’s position: Content that was commissioned and paid for belongs to the client — in Malaysia by statutory default, elsewhere by the express or implied terms of the deal. An agency demanding paid-for content be “returned” or deleted after termination is, in almost every case, overreaching.
The agency’s position: Narrower, but real. Unpaid content is different from paid content — if invoices for that work are outstanding, the agency has a defensible claim that ownership never passed. The agency also keeps its background IP: the frameworks, templates, and methodology used to produce the work.
The client owns the 200 articles. It does not own the system that produced them.
- The Flashpoint: Content Removal
The most dangerous self-help tactic in this industry is an agency logging in after termination and deleting content over a payment dispute. If the content was paid for, that’s interference with the client’s property and almost certainly breach of contract. Depending on how access was used, it can stray toward computer misuse statutes.
Even where invoices are genuinely unpaid, courts strongly prefer demand and litigation over self-help that inflicts disproportionate damage. An agency that tanks a client’s organic traffic to collect a five-figure invoice may face a six-figure counterclaim. The safer leverage — covered below — is withholding handover of things not yet delivered. Not reversing things already delivered.
The Website: Code, Themes & The Licensing Trap
Where the agency also built or maintains the site, ownership splits into three layers nobody separates at signing:
- Bespoke work – Custom code, custom themes, original design. Same copyright analysis as content; in Malaysia, presumptively the client’s.
- Licensed components – The trap. Premium themes and plugins are licensed to the purchaser. If the agency bought them under its own account, those licenses often can’t be transferred at all. The client may keep using the installed software but loses updates — which on WordPress becomes a security problem within months.
- Open-source components – WordPress core and GPL plugins belong to no one in the relevant sense. But agency-customized GPL code inherits GPL terms, which surprises agencies that thought their modifications were proprietary.
- The Domain Name: Priority Zero
The most serious failure in this category isn’t code. It’s the domain.
If the agency registered the client’s domain under its own registrar account, it holds the client’s entire business hostage by default — whether it intends to or not.
Domain registration belongs in the client’s name, in the client’s registrar account. Full stop. A client who discovers at termination that they don’t control their own domain should treat recovering it as priority zero, ahead of every other handover item.
Backlinks: The Asset Nobody Can Own
A backlink is an HTML element on a third party’s website. The third party owns it.
Neither client nor agency can transfer or repossess a link, and no contract between them binds the publisher hosting it. What the parties actually fight over is everything around the links.
Link Records
A complete inventory of links built during the engagement — URLs, anchors, dates, context — is a deliverable the client should receive at handover.
Without it, the client can’t audit its own profile, can’t respond to a future penalty, and can’t brief a successor agency.
The defensible middle ground: the client gets the list of its links. The agency keeps its prospecting database, outreach contacts, and publisher relationships.
The client paid for the links. It didn’t buy the agency’s Rolodex.
Paid & Maintained Placements
A large share of real-world link profiles involve recurring costs — sponsored posts with annual renewals, links on networks the agency operates, paid listings.
When the retainer stops, the payments stop. Those links quietly disappear over the following months.
Neither side handles this honestly very often. Clients deserve to know, before signing, which links are permanent and which are rented. At exit, they deserve a list of placements with renewal obligations so they can take over payments.
An agency that lets rented links lapse after a hostile exit — without ever disclosing they were rented — invites a misrepresentation argument. An agency that actively removes links as retaliation is in the same dangerous territory as deleting content.
The Disavow File
If the agency maintained one, it’s part of the site’s technical state and must be handed over. A successor who doesn’t know a disavow file exists can spend months chasing phantom problems.
Search Console, GA4 & Platform Accounts
This category causes more permanent, irreversible loss than any other — not because the law is unclear, but because platform mechanics punish setup choices made years earlier.
Google Search Console
GSC has no concept of contractual ownership. It has verified owners and delegated users.
Best practice is unambiguous:
- The client holds owner-level verification (ideally DNS verification on a domain property).
- The agency is added as a user.
- At termination, the client removes agency access in 30 seconds.
The pathological setup — still common — is the property verified only under the agency’s account. The client is locked out of its own search data, and in hostile exits faces an ex-agency that can still see and change settings.
If you’re a client reading this mid-engagement: check today whether you hold owner access to your own Search Console. It’s a two-minute check that prevents the single most common handover crisis.
Most clients have never done that check. Some agencies are counting on it.
Google Analytics 4
GA4 is harsher. Historical data lives inside the property, and there’s no native way to export full event history without a BigQuery link configured before the data was collected.
If the GA4 property was created under the agency’s account and never transferred, years of behavioral data are simply gone.
Not withheld. Not hostage. Gone — no contract clause, court order, or apology recovers data that was never exportable.
The contract should oblige the agency to add the client as administrator and move the property into the client’s organization. But the structural lesson is the same as GSC: properties belong in the client’s account from day one, with the agency as a user.
Google Business Profile, Tag Manager & The Rest
The same principle generalizes. GBP has a formal ownership-transfer process and a (slow, evidentiary) reinstatement path for locked-out businesses. Tag Manager containers, Meta Business Manager assets, and ad accounts all follow the account holder — not the invoice payer.
The clause every client should insist on, and no reasonable agency should resist:
All platform accounts and properties relating to the client's business shall be created under, or transferred to, accounts controlled by the client, with the agency holding delegated access only.
Whose Data Is It, Anyway?
Analytics and CRM data frequently contain personal data — form fills, user identifiers, remarketing audiences.
In Malaysia, the Personal Data Protection Act 2010 applies, and the 2024 amendments added breach notification duties and direct obligations for data processors — a category that squarely covers agencies handling client customer data.
An agency keeping a copy of the client’s lead data after termination isn’t holding leverage. It’s holding liability.
Strategy Docs, Audits, Keyword Research & Reports
Here, one distinction does all the work: deliverables vs. internal work product.
Deliverables belong to the client. The audit it paid for, the keyword research presented to it, monthly reports, and the migration redirect map. They were the thing being purchased.
The redirect map deserves special emphasis. It’s the least glamorous document in SEO and the most catastrophic to lose — a future migration without it can silently destroy rankings that took years to build. It goes in the handover package. Every time.
Internal work product stays with the agency. Scoring models, SOPs, prompt libraries, rank-tracking configurations inside the agency’s own tool subscriptions, templates.
A client is entitled to exports of its data from the agency’s tools — ranking histories for its keywords, crawl exports for its site. Not the tools, the configurations, or the methodology.
The clean contractual fix is a definition: Deliverables are works created specifically for the client and provided to it. Background IP is everything the agency owned before or develops for general use. Deliverables transfer; background IP is licensed only as embedded in deliverables.
The Unpaid Invoice Problem
Almost every ugly handover dispute has the same engine: money owed. It deserves direct, evenhanded treatment.
- The client's position
A client disputing invoices in good faith — over scope, quality, or unauthorized rate increases — is entitled to dispute them. Disputed amounts stand differently from undisputed ones.
But a client can’t both withhold payment for delivered work and demand the full white-glove handover as if the account were in good standing.
The pragmatic resolution in most real disputes: a settlement exchanging payment (often adjusted) for a defined, complete handover package with a deadline. The client’s alternative is litigating while flying blind. The agency’s alternative is chasing a debtor while its reputation sits in the debtor’s hands.
- The Agency’s position
An agency owed money isn’t obliged to keep working — and generally isn’t obliged to perform new acts of handover (preparing documentation, executing transfers, transition support) while undisputed invoices sit unpaid.
Conditioning the handover package on settlement is ordinary commercial pressure. A clause stating IP transfers only on payment in full converts that pressure into a clean legal right.
In Malaysia, contract claims carry a six-year limitation period, and a letter of demand — followed by a statutory demand where the debtor is a company and the debt undisputed — concentrates minds quickly.
The Line The Agency Must Not Cross
- Withholding future cooperation is leverage. Reversing past performance is sabotage.
Deleting content. Breaking redirects. Removing links. Cutting off hosting or a domain the agency controls. Locking the client out of accounts it’s entitled to.
Each of these converts a payment dispute the agency would likely win into a damages dispute it may lose badly — because the client’s losses from destroyed organic traffic can vastly exceed the debt.
Courts consistently reward the party that behaved proportionately and documented everything.
- Legitimate leverage
- Withhold new work
- Withhold handover package
- Charge for transition support
- Letter of demand
- Never do this
- Delete content
- Break redirects
- Remove links
- Cut off domain or hosting
- Lock client accounts
The 8 Clauses That Decide Everything
Every dispute above is cheap to prevent and expensive to resolve. Prevention is roughly eight clauses, negotiated before signature.
Conditional IP assignment
All IP in deliverables assigns to the client automatically upon payment in full of the related invoices. The client gets clean ownership of everything it paid for; the agency gets real security for everything it hasn’t been paid for. Both sides can defend this.
Background IP definition
Separate deliverables from the agency’s pre-existing and general-purpose materials, with a perpetual license to the client for background IP embedded in deliverables.
Account ownership
All platform properties and the domain registration sit in client-controlled accounts; agency access is delegated; anything created in breach must be transferred on demand.
Handover clause
Enumerate the exit package by name: content source files, credential transfers, the link inventory with renewals flagged, the disavow file, the redirect map, technical documentation, data exports — within a defined window (14–30 days is typical), conditional on settlement of undisputed amounts.
Transition assistance
A capped block of post-termination support hours at a stated rate, so the successor agency’s questions have a paid, bounded answer instead of becoming a goodwill dispute.
No-sabotage covenant
Binding both ways: the agency won’t remove or degrade delivered work after termination; the client won’t misrepresent the agency’s work. It sounds redundant with general law — in practice, seeing it in black and white de-escalates the worst impulses on both sides.
Portfolio rights
The agency’s right to describe the engagement and results in marketing, subject to confidentiality. Agencies that skip this clause end up claiming rights they never secured.
Survival
The IP, confidentiality, handover, and no-sabotage clauses must expressly survive termination — because they only ever matter after it.
Legal References (Malaysia, With Comparative Notes)
For readers tracing the analysis to its sources:
Copyright Act 1987
Governs content, code, and creative work. Section 10 establishes eligible works; section 26 governs first ownership, with section 26(2) providing the deemed transfer of commissioned works to the commissioner. Assignments and exclusive licenses must be in writing.
Contracts Act 1950
The general law of the service agreement: formation, breach, damages. Malaysian courts will imply terms necessary for business efficacy — the route by which a client without an IP clause may still establish an implied license.
Specific Relief Act 1950
Injunctions and specific performance: the remedies a client reaches for when an agency withholds account access or a domain, and vice versa for misused background IP.
Limitation Act 1953
Six-year limitation for contract claims, framing how long either side’s exposure realistically lasts.
Personal Data Protection Act 2010 (as amended 2024)
Governs customer data in analytics, CRMs, and lead forms. The amendments extended direct obligations to data processors and introduced mandatory breach notification — making post-termination retention of client lead data a compliance problem, not a bargaining chip.
Computer Crimes Act 1997
Criminalizes unauthorized access and unauthorized modification of computer material. “Authorized during the engagement” does not mean “authorized after it, for retaliation.”
Comparative notes: In the U.S., the work-made-for-hire doctrine (17 U.S.C. §101) means independent-contractor work belongs to the contractor absent written agreement — the inverse of Malaysia’s default. In the U.K., section 11 of the CDPA 1988 makes the author the first owner of commissioned work, with clients relying on assignments or implied licenses.
The practical conclusion holds everywhere: statutory defaults are tiebreakers for the unprepared. A clear contract beats all of them.
The Final Take: Ownership Is A Day-One Decision, Not A Breakup Negotiation
Strip this article to its verdict: by default, you do not own most of what your SEO retainer produces — and the parts you do own (Malaysia’s Copyright Act sides with you on commissioned content) aren’t the parts that hurt at exit. Accounts, the domain, the data, the link relationships: those live or die on how things were set up on day one, and no amount of arguing at breakup fixes a registrant field that was wrong for three years.
If you’re a business owner with an agency right now
Run the four-asset audit this week, while the relationship is healthy:
- Whose name is in your domain registrant field
- Who holds Owner — not just user — on Search Console and GA4
- Who has admin on hosting and the CMS
- What your contract’s IP clause actually says, if it says anything.
Then put the eight clauses from this article into your next renewal. None of this is hostile — framed as housekeeping, good agencies agree in minutes. The ones that resist just answered a different question for you.
If you’re an agency or consultant
Clean ownership is a sales weapon, not a concession. Offering the clause set unprompted converts trust at pitch stage, kills the single most common source of end-of-engagement disputes, and costs you nothing you were entitled to keep. And on leverage: withhold new work, withhold the handover package, charge for transition — but never touch what’s live. Sabotage converts a fee dispute you’d win into legal exposure you won’t.
The one-sentence version
Own the domain, own the accounts, and put the eight clauses in writing while everyone’s still friends — because the day you need them is the day it’s too late to ask.
FAQ
Does a client own blog posts an agency wrote if the contract never mentioned IP?
In Malaysia, yes by default — section 26(2) of the Copyright Act 1987 deems copyright in commissioned work transferred to the commissioner absent contrary agreement. In the U.S. and U.K., the default favors the agency, and the client typically holds only a license. Everywhere, the contract overrides the default.
Can an agency take down content or a website over unpaid invoices?
Withholding new work and the handover package is legitimate pressure. Actively removing delivered work, breaking a live site, or cutting off a domain is self-help that courts disfavor — and can expose the agency to damages far exceeding the debt, plus potential computer-misuse liability where login access is abused.
Who owns the backlinks?
Nobody, in the property sense — they live on third-party sites. The client is entitled to the inventory of links built for it, with renewal-cost placements disclosed. The agency keeps its outreach relationships and prospecting databases.
What happens to GA4 history if the property sits in the agency's account?
Unless the property is transferred or a BigQuery export was configured in advance, the full historical data is effectively unrecoverable. This is the strongest argument for client-owned properties from day one.
Can an agency reuse work created for one client with another?
Background IP — frameworks, templates, methodology — yes, and the contract should say so. Client-specific deliverables — its content, its bespoke code — no, once IP has assigned.
What should a handover package contain, at minimum?
Transfers of every platform account and the domain; content in source form; the complete link inventory with renewals flagged; the disavow file; the redirect map and technical documentation; exports of the client’s data from agency tools; and a credentials list — within a defined window after termination.
Reviewing an agency agreement, or planning a handover from either side of the table? We maintain a standard handover checklist covering every item in this guide — the accounts, the documents, and the clauses — and we’re happy to share it. [Drop us a line] and we’ll send it over.
This guide is general information about industry practice and applicable legal frameworks. It is not legal advice. For a specific dispute or contract, consult a qualified lawyer in your jurisdiction.
Sterrific Agency
We’re a digital marketing agency based in Malaysia, specialising in SEO, local SEO, and technical SEO. We work with business owners who want their search visibility built on foundations they can actually trust — and own. If you’ve been through something similar to the story above, we’d genuinely like to hear about it.
