On Monday 24 August 2026 a lot of people woke up to an email from Search Console saying a new owner had been added to a property. The reaction was the same everywhere: alarmed at first, then relieved, because the notifications turned out to name someone who already had access.
Google has since confirmed it was a bug. The Search Console help forum thread that collected the reports is titled, plainly enough, “Repeated new owner added emails for existing owners”. There was also a Reddit thread from people getting spammed with them.
So the answer this week is: probably nothing happened. But “probably” is doing real work in that sentence, and this is the one Search Console notification where the cost of assuming wrong is not symmetrical. A duplicate email you investigate costs you four minutes. A genuine unauthorised owner you dismiss as a known bug costs you the site.
Why an unexpected owner is worth four minutes even in a bug week
An owner in Search Console is not a viewer. Google’s documentation is blunt about the scope: an owner “has full control over properties in Search Console”, can add and remove other users, configure settings, view all data, and use all tools.
That includes the tools that can take a site out of Search. Removals. Change of address. Disavow links. Sitemaps. Those are not read-only capabilities, and they do not require access to your server or your CMS. Someone who reaches owner on your property does not need to touch your site to hurt it.
This is why the standard advice of “it is a known bug, ignore it” is not quite the right shape. The right shape is: it is a known bug, so this will take four minutes rather than an afternoon, and you should still do it.
The check
Settings, then Users and permissions. You have to be an owner to see this page at all.
Read the Permission column against the two words Google uses there. If someone is listed as Owner and Verified, they are a verified owner: they proved ownership with a token on your site, an HTML file, a meta tag, a DNS record, an analytics or Tag Manager account. If someone is listed as Owner without Verified, they are a delegated owner: an existing owner simply granted it, with no token involved.
Then compare the list against people you can name. Your team, your agency, your developer, whoever set up Analytics four years ago. On sites with any history, this list is usually longer than the client believes, and the extra entries are almost never malicious. They are the previous agency, the freelancer who built the theme, a Tag Manager container nobody removed.
If every name resolves, you are done, and the email was the bug.
If a name does not resolve
The removal is not the same job for the two types, and this is where people get it wrong.
For a delegated owner, remove them on the Users and permissions page. Google’s documentation says access ends immediately. That is the whole job.
For a verified owner, removing the account is only half of it. Google is explicit: “If you do not delete these tokens, the removed owner will be able to re-verify ownership if they choose to.” When you remove them, Search Console shows you the tokens tied to that person, and there is an Unused ownership tokens list on the same page. Delete all of them, and if they verified by more than one method, delete every one. Then go and remove the corresponding thing from your site: the HTML file, the meta tag, the DNS TXT record.
Two warnings that matter more than they sound. Removing all verified owners means everyone loses access to the property after a grace period, so verify yourself first. And a token you cannot account for on your own site is a bigger finding than the Search Console entry was, because it means someone could put a file or a DNS record where your site serves it.
What I actually do about this
Every account I run gets its user list read at handover and never again until something like Monday happens. That is the honest version, and this week is a decent argument for it being too rarely.
The thing I have changed after this one is smaller and more useful than a calendar reminder: I now screenshot Users and permissions at handover and keep it with the account notes. The reason is that the hard part of Monday’s check was never the removal, it was answering “was this person always here?” from memory. A list from the day I took the account over answers that in seconds, and it is the difference between four minutes and an email chain.
Two other things worth saying, because both came up when clients forwarded me the email.
It is not related to the favicon bug or the crawl stats gap, which Google fixed over the same weekend. August 2026 has simply been a busy month for Search Console defects, and grouping them into one story is how people end up assuming a fourth thing is also a bug when it is not.
And it does not touch your indexing. Owner notifications, indexing status and performance data are separate systems, and nothing in this affected any of them. If pages went missing in the same week, that is a different investigation, and it starts in pages dropped out of the Google index rather than here.
Sources
- Google Search Console Help forum, Repeated new owner added emails for existing owners, August 2026, including the confirmation that this was a bug
- Google Search Console Help, Managing owners, users, and permissions, checked 25 August 2026
- r/SEO, GSC notification bugs, getting spammed with new owner emails, August 2026