If you are an administrator of a Google Analytics 4 property, it is normal to assume that you can also edit all the settings related to its measurement. However, when you open the web data stream and access the Google tag settings, the interface may tell you that you only have read-only access.
This does not mean that the GA4 property is incorrectly configured or that the tag has stopped collecting data. In many cases, the issue is related to the permissions of the Google tag itself, which do not always depend only on the role you have within Analytics.
Contents
Why this issue does not depend only on GA4
To understand this problem, it is useful to separate three concepts that are often mixed together: the GA4 property, the web data stream and the Google tag. They are related, but they are not exactly the same thing.
The GA4 property is the space where data is collected and analysed. The web data stream is the configuration that identifies the website from which that data is coming. The Google tag, on the other hand, is the tag installed on the website, and it can send information to one or more Google products.
That is why, even if you access the tag from the GA4 data stream, its permissions do not always depend only on Analytics. Google explains that access to a Google tag works differently depending on the destinations associated with that tag. If the tag is connected to more than one destination, permissions may be inherited from those connected products, not only from the GA4 property.
This is usually the confusing part. You may have an administrator role in Analytics and be able to see the property correctly, but that does not necessarily mean that you have full permissions over the Google tag. In practice, GA4 may be receiving data without any issue while, at the same time, the tag appears as read-only when you try to edit its settings.
What read-only mode in the Google tag means
When GA4 tells you that you have read-only mode access in the Google tag settings, the message is quite literal: you can view the configuration, but you cannot edit it. It is not a display issue or a temporary problem with the interface. It is a permissions limitation.
This can affect settings such as domain configuration, cross-domain measurement, automatic event detection or some tag-specific settings. The screen may be visible from the web data stream, but the changes will not be available because your user does not have permission to update that tag.
Google distinguishes between being able to view a tag and being able to change its configuration. Users with read access can view users and settings, but they cannot make changes. To update tag settings, the user needs publish permission. And to manage users, destinations or more advanced actions on the tag, the user needs an administrator role for that Google tag.
That is why, in this case, the read-only message should not be interpreted as a problem with the data stream. The stream may be correctly configured and the tag may still be sending data to GA4. What is limited is your ability to manage that tag from the Google Analytics 4 interface.
Why you can be a GA4 administrator and still not be able to edit the tag
This usually happens when the Google tag was not originally created from that Analytics property. For example, the tag may have been set up first from Google Ads and GA4 may have been added later as another destination for that same tag.
In that scenario, you may have administrator permissions in GA4 and be able to see the web data stream correctly, but that does not guarantee that you have full control over the tag. The tag is connected to Analytics, but its permissions may also come from the product where it was created or from other associated destinations.
Google’s documentation explains this through tag destinations. If a Google tag has multiple destinations, users inherit the corresponding access from each connected product. In other words, it is not enough to check which role you have in GA4. You also need to understand which other products are connected to that tag and where its permissions are being managed from.
That is why this situation is common in accounts where Google Ads was used first and GA4 was configured later. Measurement may be working correctly, but the user who manages Analytics is not necessarily the same person who has enough permissions over the Google tag.
How to check where access is managed from
The first place where you will usually see this is inside the GA4 web data stream itself. When you open the Google tag settings, the interface may show in the top-right corner that you have read-only mode access. That message is the clearest sign that your user can view the configuration, but cannot update it.
From there, I would not limit the review to the Analytics property permissions. I would also check the destinations associated with that Google tag, which appear in the same GA4 settings section, because access may be inherited from the connected products. Google explains that, when a tag has multiple destinations, users automatically inherit the role and permission that correspond to each associated destination.
This is especially important if the tag is connected to Google Ads or another Google product. In that case, the person with sufficient permissions may not be the GA4 administrator, but the person who has administrator access in the product from which that tag is managed, or in one of its connected destinations.
In practice, if you see read-only mode in GA4, the next step should not be to change the implementation or create a new tag. First, it is better to identify which destinations are associated with that Google tag and from which product access can be properly managed.
What to do to recover permissions
If the Google tag appears with read-only access, the solution is not to keep changing the user’s role inside GA4 again and again. If you are already an administrator of the property, the next step is to find out who can manage the tag or the product from which its permissions are inherited.
In many cases, that person will be in Google Ads, especially if the tag was created there before being connected to GA4. If someone has sufficient permissions in that product, they will be able to review access to the tag and grant you the permissions you need to edit its configuration.
The tag may also have several associated destinations. In that case, Google allows users to be added directly to the Google tag, but only a user who already has an administrator role for that tag can do it. Being able to view the tag is not enough. The user needs permission to manage its users.
That is why, before modifying the implementation, the most practical approach is to identify the person or account that still has real control over the tag. If measurement is working and the only problem is read-only mode access, you normally do not need to create another tag or change the website code. You need the right user to grant you permissions over the Google tag or over the product from which it is managed.
What to do if nobody still has access
Sometimes the problem is not only about permissions, but about ownership of the tag. The tag may have been created by an agency, by someone who no longer works at the company, or from a Google Ads account that the current team can no longer access. In that case, there is nobody you can ask to add you as an administrator of the Google tag.
When you reach that point, the solution is no longer to review GA4 permissions again. You need to start a recovery process and prove that the website or app sending data to Analytics belongs to you.
If this is your case, I recommend reading my article on how to recover a Google Analytics 4 account without administrator access, where I explain the process in more detail and the most common mistakes that can cause the request to fail.
In summary, if the Google tag appears with read-only mode access, it is not enough to check whether you are an administrator of the GA4 property. The tag has its own permissions, and access may also depend on connected destinations, such as Google Ads or other Google products.
That is why the next step should not be to change the implementation, but to review who can actually manage that Google tag. In many cases, measurement is working correctly and the only thing missing is having the right permissions to edit its configuration.
