Google Business Profile: Who Really Controls Your Listing

Most businesses did not create their Google Business Profile. They found it. Somebody searched for the company name one day, saw a panel on the right of the results page with an address, a phone number, a photo taken by a stranger, and a rating out of five, and thought: who put that there? The answer is that Google did, from sources you never chose, and the only thing claiming the profile changes is who gets to correct it.

2. Where the Name Comes From

Few products have been renamed five times in twenty years. The sequence is worth reading, because each name describes what Google thought the thing was at the time.

The interesting change is the last one, and specifically the word that was dropped. "Google My Business" named a console you logged into, separate from Search. "Google Business Profile" names the thing customers see. That was not marketing; it matched a real change in how the product works. Google moved single-location management out of the console and into Search and Maps themselves, retired the standalone Google My Business mobile app, and renamed the surviving web console Business Profile Manager, aimed mainly at businesses with several locations.

This is why so much advice on the web tells you to "log in to Google My Business" and then gives a click path that does not exist. If you run one location, there is no dashboard to log into. You search for your own business while signed in to the Google Account that owns it, and you edit it there.

The old name survives in one important place: the developer documentation. The APIs live under developers.google.com/my-business, the hostnames start with mybusiness, and the legacy version is still called the Google My Business API. Section 6 uses those names because Google still does.

4. Simple Use Cases

4.1 The Simplest Useful Question: What Does It Already Say?

Before you claim anything, look at what is there. Sign out of your Google Account, or open a private browsing window, and search for the business name and the town. What you see is what a customer sees, without the editing controls that confuse the picture when you are signed in.

example searches, in a private window

  De Koffiehoek Utrecht          <- name plus town
  koffiezaak Utrecht Oudegracht  <- what a customer would type
  "De Koffiehoek"                <- exact name, to spot duplicates

Work through this list and write down what you find. It takes ten minutes and it is the whole audit:

• Does a profile exist? If it does and nobody has claimed it, you will see a "Claim this business" or "Own this business?" link.
• Is there more than one? Search the name on Maps and pan around. Duplicates are common after a move, a rebrand, or a well-meaning employee.
• Is the category right? It is printed under the business name. Section 4.4 explains why this one line matters more than the rest of the profile put together.
• Are the hours right today? Including this week's public holiday.
• Which photo is showing first? Google picks it, and it is often a customer's photo of a car park.
• What is the newest review, and did anyone reply?

4.2 Claiming and Verifying

If the profile exists, claim it rather than creating a new one. Creating a second record for a place that Google already knows about produces a duplicate, and duplicates are harder to resolve than an awkward claim.

Two practical points that save a lot of pain later. First, claim it with an account you will still control in five years. A profile tied to a departed employee's personal Gmail address is a genuinely difficult problem to unwind. Use a company account, then add colleagues as managers. Second, get the address and phone number exactly right before you request verification, because the verification method Google offers you is chosen from the details on the profile at that moment.

If the business has already been claimed by someone else, Google runs a request-access flow. "The current profile owner is then notified by email and has 3 days to respond." If they approve, you get access. If they refuse, you can appeal or fall back to suggesting edits. If they never answer, you may then have the option to claim the profile yourself by verifying the business.

That three-day window is the reason the previous paragraph matters. It works only if somebody still reads the mailbox the profile was claimed with. When the claiming address belongs to an agency that folded or a colleague who left in 2019, the request simply expires into the second route, and you are back to a postcard.

4.3 The Fields That Actually Matter

A profile has dozens of fields. Six of them do nearly all the work.

On the name field, be clear about what the rule is and what it is not. Google prohibits marketing taglines, store codes, trademark symbols, fully capitalised words, phone numbers, website URLs, and service or location information appended to the name. "De Koffiehoek" is the name. "De Koffiehoek | Best Coffee & Brunch Utrecht Centrum" is a violation, and it is one of the most commonly reported ones, because it works well enough that people keep trying it.

4.4 Categories: The One Field to Get Right

The category is not a label. It is the filter that decides which searches your profile is even considered for. A profile in the wrong category can be perfect in every other respect and still never appear, because Google is not looking at businesses of that type for that query.

You choose one primary category and up to nine additional ones. Google does not publish how it weighs them, but it asks you to "Select a primary category that best describes your business", and that is the one printed under your business name in search results, so treat it as the field that defines you. Google's guidance on choosing is short and worth following exactly:

• Be specific. "Select a specific category from the list that shows up. For example, instead of 'Salon,' choose 'Nail salon.'"
• Describe what the business is, not what it has. Categories should complete the sentence "This business IS a", never "this business HAS a". A supermarket with a bakery counter is a supermarket that may add Bakery as a secondary category. It is not a bakery.
• Use as few as possible. "Do not select a category for every product or service." Extra categories dilute rather than add, and using them as keywords is a policy violation.

A worked example of the difference, for a business that repairs bicycles and also sells a few new ones:

WRONG                              RIGHT
Primary:    Store                  Primary:    Bicycle repair shop
Additional: Bicycle shop           Additional: Bicycle store
            Bicycle repair shop
            Sporting goods store
            Cycling shop
            Bicycle rental service
            Repair service

Seven categories chosen as         Two categories describing what
keywords. The primary one is       the business IS. The primary one
so broad it competes with          matches the query that actually
every shop in town.                brings in money: "bike repair".

Changing the primary category on an established profile is one of the few edits that can visibly move a business in local results within days, in either direction. Change it deliberately, note the date, and watch the performance report afterwards.

4.5 Hours, and the Ones People Forget

Opening hours are the field customers act on most directly, and the "Open now" line in search results is generated from them. Two things go wrong regularly.

Special hours. Regular weekly hours do not know about public holidays. If you do not set special hours, the profile will cheerfully tell people you are open on a national holiday. Set them for the whole year in one sitting.

More-hours fields. Many categories support extra hour types, such as kitchen hours for a restaurant or delivery hours for a shop. These are separate from the main opening hours and are worth filling in where they exist, because "the kitchen closes at 21:00" is exactly the question a customer is asking at 20:45.

4.6 Why Your Edit Has Not Appeared Yet

You change the opening hours, you save, and nothing happens. An hour later the old hours are still showing. This is the single most common frustration with the product, and it is not a bug. Your edit is in a queue.

Google states the mechanism plainly: "Edits that you make to your verified Business Profile are reviewed to ensure they follow our guidelines." Every change is a proposal until Google accepts it. So an edit ends in one of three states:

Look hard at the pending range, because it is the answer to the question people actually ask. Usually 10 minutes. Sometimes up to 30 days. There is no progress bar between those two numbers and no way to ask for a review to be hurried. That is a three-thousand-fold spread on the same operation, which is why one person's experience of this product is "instant" and another's is "broken".

The phrase to hold on to in the rejection case is "can't confirm its accuracy". Google is not judging whether your edit is allowed so much as whether it can corroborate it, and corroboration comes from the four sources in section 1.2. This gives a practical route when an edit will not stick: change the outside world first, then change the profile. If your new phone number appears on your website, in your footer, on your invoices and in the other directories that list you, the edit is a fact Google can confirm. If the profile is the only place in the world where the new number exists, you are asking Google to take your word for it against everything it has crawled.

A pattern worth naming, with a caveat: Google does not publish which fields draw the closest scrutiny, but in practice the fields that carry the most spam risk behave the most slowly. Photos and posts usually appear at once. The name, the address, the category, and the phone number are the four that spam abuses, and they are the four most likely to sit pending or come back refused. Plan a rebrand or a move around that, rather than discovering it on the day.

Two related delays that have their own numbers: service-area changes can take up to 48 hours to show (section 5.1), and if the edit was significant enough it may trigger reverification instead of a review, which is a different and much longer process (section 1.4).

6. Advanced Use Cases

Everything above happens in a browser. Once you manage many locations, or want profile data in the same place as the rest of your reporting, there is an API family underneath. It is more work to reach than most Google APIs, and it is split into more pieces than most people expect.

6.1 Getting Access Is a Gate, Not a Setting

You cannot simply enable the Business Profile APIs in a Google Cloud project and start calling them. Google requires an application. The documented prerequisites are:

• A Google Account and a Google Cloud project, with the project number to hand.
• A verified and active Business Profile that is at least 60 days old.
• A website representing the business on that profile.
• The email address you apply with must be listed as an owner or manager of that profile.
• A request submitted through the Business Profile API contact form, choosing "Application for Basic API Access" from the drop-down.

Approval is not instant, and Google's own way of telling you whether it happened is indirect but reliable: look at the API quota in the Google Cloud console. 0 QPM means the request has not been approved. 300 QPM means it has.

Plan for this. A project that assumes API access on day one and discovers a 60-day profile-age requirement has a scheduling problem, not a coding problem.

Once you are through, keep two separate permissions clear in your head, because they fail in ways that look identical from the outside:

• Your project is allowed to call the API. That is the approval above, and until it lands the API is not even visible in the Google API console.
• The signed-in user is allowed to manage that profile. That is ordinary owner or manager access from section 5.6, granted per profile, and no amount of project approval substitutes for it.

Everything runs on one OAuth 2.0 scope across the whole family:

https://www.googleapis.com/auth/business.manage

There is a third gate that catches people in larger organisations, and its symptom is misleading. If the account belongs to a Google Workspace organisation, an administrator has to have Business Profile turned on for it. If they have not, calls return 403 even though the project is approved and the user is a genuine owner of the profile. That is a Workspace setting, not an API problem, and no amount of re-reading your OAuth code will find it.

6.2 One Product, Eight APIs

The old Google My Business API v4 did everything. Google broke it up, and the pieces have separate hostnames, separate quotas, and separate documentation. What is left in v4 is as interesting as what moved out.

That last row surprises people. Years after the split, replying to a review through the API still means calling accounts.locations.reviews on v4. Any code that touches reviews is code that depends on the version Google has been retiring around it, so isolate it behind one module and expect to rewrite that module one day.

The APIs that have already gone are worth knowing about too, because they date most of the tutorials you will find:

6.3 The Performance API

The Performance API answers one question well: how many of a given interaction happened on a given day. The metric names are the vocabulary, and they are more specific than the interface labels:

BUSINESS_IMPRESSIONS_DESKTOP_MAPS     impressions, split four ways by
BUSINESS_IMPRESSIONS_DESKTOP_SEARCH   surface (Maps / Search) and by
BUSINESS_IMPRESSIONS_MOBILE_MAPS      device (desktop / mobile)
BUSINESS_IMPRESSIONS_MOBILE_SEARCH

BUSINESS_DIRECTION_REQUESTS           direction requests
CALL_CLICKS                           taps on the call button
WEBSITE_CLICKS                        taps on the website link
BUSINESS_BOOKINGS                     bookings via Reserve with Google
BUSINESS_FOOD_ORDERS                  food orders
BUSINESS_FOOD_MENU_CLICKS             menu views and interactions
BUSINESS_CONVERSATIONS                message conversations (historical)

Note what the four impression metrics give you that the interface does not present as clearly: a split between Maps and Search. A profile whose impressions are almost entirely Maps is being found by people already looking at a map of the area. One whose impressions are almost entirely Search is being found by people typing a need. Those are different customers and they justify different work.

A single metric over a date range looks like this:

$ curl -s \
    -H "Authorization: Bearer $TOKEN" \
    "https://businessprofileperformance.googleapis.com/v1/locations/LOCATION_ID:getDailyMetricsTimeSeries\
?dailyMetric=WEBSITE_CLICKS\
&dailyRange.start_date.year=2026&dailyRange.start_date.month=7&dailyRange.start_date.day=1\
&dailyRange.end_date.year=2026&dailyRange.end_date.month=7&dailyRange.end_date.day=31"

{
  "timeSeries": {
    "datedValues": [
      { "date": { "year": 2026, "month": 7, "day": 1 }, "value": "14" },
      { "date": { "year": 2026, "month": 7, "day": 2 }, "value": "9"  },
      ...
    ]
  }
}

Two details of the shape are worth noticing. The date is a structured object rather than a string, so the query parameters are dotted paths, and the value comes back as a string, not a number, which is a JSON convention for 64-bit integers and a common source of silent bugs when the result is summed without conversion.

For several metrics at once there is locations.fetchMultiDailyMetricsTimeSeries, which is the method to use in any real pipeline: one call per location per period instead of one call per metric.

6.4 Search Keywords, and the Threshold

The other half of the Performance API is the keyword report, and it works differently from everything else. It is monthly, not daily, and it lives at its own resource:

GET https://businessprofileperformance.googleapis.com/v1/locations/LOCATION_ID
      /searchkeywords/impressions/monthly

{
  "searchKeywordsCounts": [
    { "searchKeyword": "bicycle repair utrecht",
      "insightsValue": { "value": "412" } },
    { "searchKeyword": "fix bike brakes near me",
      "insightsValue": { "threshold": "15" } }
  ]
}

Look carefully at the second entry. There is no value. Google documents insightsValue as one of two things: either "The sum of the number of unique users that used the keyword in a month", or "A threshold that indicates that the actual value is below this threshold".

This is not a bug and it is not sampling. It is a privacy floor. Below a certain number of unique users, Google will tell you the term exists but not how often it was used. The practical consequences:

• Never sum this report. A total built by treating every threshold as its printed number is meaningless, and treating it as zero is worse.
• The long tail is real but uncountable. Most profiles have far more distinct terms than countable ones. You can list them and read them; you cannot rank them.
• Count the terms, not the impressions. The number of distinct keywords below the threshold, tracked month over month, is a usable signal even though the impressions behind it are not.

And note the metric it counts: unique users per month, not searches. The same person searching your category every week is one.

6.5 Notifications Instead of Polling

Polling every location for new reviews is the obvious design and the wrong one. The Notifications API pushes events into Google Cloud Pub/Sub: "The My Business Notifications API uses Cloud Pub/Sub to deliver notifications about various business events, such as new reviews, Q&As, and location updates."

The setup has one step people miss. After creating the Pub/Sub topic, you must grant publish permission to Google's own service account before linking it:

1. Register the application, get OAuth 2.0 credentials
2. Create a Cloud Pub/Sub project and a topic
3. Grant  pubsub.topics.publish  to
     This email address is being protected from spambots. You need JavaScript enabled to view it.
4. Add a push or pull subscriber to the topic
5. Link the account to the topic:
     accounts.updateNotificationSetting

To stop notifications, update the setting with an empty pubsubTopic. The available event types include new and updated reviews, questions and answers, media uploads, Google updates awaiting review, and location state changes.

6.6 Quotas, and the One That Cannot Be Raised

Most of the family shares a default of 300 queries per minute: Account Management, Performance, Verifications, Lodging, Place Actions, and Notifications. The Business Information API is the exception, and its limits are shaped by what the operations cost Google:

Default requests            300 QPM
Create Location requests    300 QPD
SearchGoogleLocation        300 QPD
Update Location requests  10000 QPD
Edits                          10 per minute per Business Profile
                               (cannot be increased)

The last line is the one that shapes architecture. Ten edits per minute per profile is a hard ceiling Google states cannot be raised, so a bulk update across many fields of one location must be batched into as few patch calls as possible rather than issued field by field. Note also that creating locations is capped per day, not per minute: onboarding a chain of 2,000 branches is a week-long job by design.

6.7 The Policies Are Stricter Than the Quotas

Quotas tell you how fast you may call the API. The API policies tell you what you are allowed to do with what comes back, and they are the document that decides whether a sensible-looking integration is permitted. They are also the ones nobody reads, because a rate limit announces itself with an error and a policy does not.

The rule that reshapes most designs concerns storage. Google's policies say retrieved content "must be stored temporarily for no more than 30 calendar days", must be stored securely, and must not be "manipulated or aggregated in any way". Alongside it sits an explicit instruction not to "pre-fetch, cache, index, or store any content", beyond limited amounts held temporarily to improve performance.

Read that against the architecture almost everybody reaches for first, which is to mirror every location into a local database, keep it forever, and reconcile nightly. A permanent local copy of Google's business data is not a clever optimisation here; it is the thing the policy describes. The compliant shape is narrower and, once you accept it, simpler:

YOUR data                 keep it. Your CMS is the source of truth for
                          name, hours, address, services.

GOOGLE'S data             temporary only. Fetch, use, discard within the
(fetched from the API)    window. Do not build a permanent mirror.

WHAT YOU SENT             keep a record of your own writes and their
                          outcomes. That is your data, not Google's.

Three more that decide real cases:

• No silent automation. You may not "automate or trigger review replies, Q&As, listing creations, listing edits, or other actions without the user's prior specific and express consent". An AI that answers reviews on a client's behalf while they sleep is not a feature, it is a policy violation unless they have specifically agreed to it.
• The googleLocations endpoint is fenced off. It may be used only to find the status of locations belonging to merchants who already have a business relationship with your company, and to create or claim those locations. Using it for "lead generation or other analysis" carries a stated consequence: "immediate revocation of your API access". Searching Google's location database to build a prospect list is the exact use it forbids.
• Clients can leave. When an end client asks you to stop, you have seven business days to give them the ability to disassociate their Business Profile account from your service. Build the off-boarding path when you build the on-boarding one.

None of this is enforced by an error code. It is enforced by review, and the penalty is access, which is why it belongs in the design conversation rather than the code review.

6.8 Where the Profile Meets the Maps Platform

The same underlying place record serves two different products, and knowing the boundary saves a lot of wasted searching.

• The Business Profile APIs are for businesses you administer. They can write. They require verified ownership.
• The Google Maps Platform Places API is for any place on Earth. It can only read. It is billed per request.

The join between them is the Place ID, which Google defines as "a textual identifier that uniquely identifies a place", for example ChIJgUbEo8cfqokR5lP9_Wh_DaM. If you are storing a reference to a location for the long term, read Google's warning first: "Place IDs may change over time", and the advice is to "refresh place IDs if they are more than 12 months old". A stale ID returns NOT_FOUND, which happens when "a business closes or moves to a new location".

So a Place ID is a good key and a bad primary key. Store it, refresh it on a schedule, and keep something of your own alongside it.

8. Best Practices

• Claim the profile with a company account that outlives any individual, then add people as managers. Keep primary ownership inside the business, never with an agency.
• Spend your thinking time on the primary category. It is the one field that decides which searches you are eligible for, and Google says outright that categories affect local ranking.
• Use the real business name and nothing else. Keyword-stuffed names are a policy violation, they get reported, and the suspension costs more than the traffic was worth.
• Set special hours for the whole year in one sitting, including every public holiday. This is the cheapest customer-experience improvement available anywhere.
• Hide the address if customers never come to you, and keep the service area within the two hours of driving time Google describes.
• Check the profile monthly against a written record of what the six key fields should say. Google changes them, the public suggests changes to them, and nobody sends you a summary.
• Ask every customer for a review, the same way, every time. Never offer anything in return, and never ask only the happy ones.
• Reply to reviews in public and without defensiveness. The reply is written for the next reader, not for the reviewer.
• Give each location its own page and tag the profile's link to it with UTM parameters, so the one outcome that reaches your website is a number you can defend. Keep the canonical URL clean.
• Read the API policies before the API reference. The 30-day storage limit, the consent rule for automated actions, and the googleLocations restriction decide whether an integration is allowed at all; quotas only decide how fast it runs.
• Export the performance data before it ages out, or pull it through the Performance API into your own store. Data you keep is data you can compare year on year.
• Prepare the suspension folder before you need it: licence, tax document, utility bill, signage photos, all scanned. The evidence form gives you 60 minutes.
• Treat anything Google hosts for you as temporary. Messaging, call history, the website builder, and the Q&A API have all been withdrawn. Your own domain has not.
• Go to the source. The product documentation is at support.google.com/business, the representation guidelines at support.google.com/business/answer/3038177, and the developer reference at developers.google.com/my-business. Features and quotas change; this article was checked against those pages in August 2026.

10. Summary

• A Business Profile is a record in Google's database of real places, shown in Search and Maps at no charge. Google builds it from crawled web content, licensed third-party data, contributions from the public, and its own interactions with the place.
• Claiming it does not give you ownership. It adds you to the list of people who can edit it, and gives you the performance report.
• Verification proves a connection to the physical location, not ownership. Review takes up to 5 business days; postcards usually arrive within 14 days.
• You no longer choose the method. Google's methods "are automatically determined by Google and can't be changed", and a live, unedited 30-second video of your premises has replaced the postcard for many businesses. Verification is not permanent: an address move requires it again.
• Every edit is reviewed before it goes live, "usually 10 minutes, but sometimes up to 30 days". Edits are refused when Google "can't confirm" them, so change the rest of the web first and the profile second.
• "Is it good for SEO?" is two questions. Local results are profiles, so a profile is a precondition there. For web results there is no documented effect, and the link Google does document runs the other way: links to your site feed your profile's prominence.
• Of the five outcomes the profile measures, only website clicks reach your website. Customers can rise while sessions fall, and that is not a failure.
• The product has been renamed five times since 2005. The 2021 rename was real: single-location management moved out of a dashboard and into Search and Maps, which is why so much published advice describes a console that no longer exists for you.
• The primary category is the highest-leverage field. One primary plus up to nine additional, chosen to complete "this business IS a", never "this business HAS a".
• Service-area businesses get up to 20 areas within about 2 hours of driving time, and should hide the address when customers never visit.
• Of the three ranking factors Google names, only relevance lives on the profile. Distance cannot be edited, and prominence is earned on the wider web and from customers.
• Google changes your profile without asking, and says outright that you cannot manage all of its updates. It may also phone, text, or WhatsApp your listed number and publish the answer.
• Anyone can suggest an edit, and anyone can request removal of a business, whether or not they own it. Check the profile on a schedule.
• Reviews cannot be switched off, incentives of any kind are prohibited, and asking without an incentive is explicitly allowed. They are also the one profile feature Google names as a ranking input: "More reviews and positive ratings can help your business's local ranking."
• A location page earns its place by answering what someone who just found you on a map still needs. Generating one per town you do not operate in is doorway abuse, which Google defines and prohibits.
• The API policies bite harder than the quotas: fetched content may be stored "temporarily for no more than 30 calendar days", you may not automate actions without the user's express consent, and misusing googleLocations for lead generation costs you your access.
• In the reports, views count unique people once per day, the search-terms list is monthly and up to 5 days late, and low-volume terms return a threshold instead of a value.
• The API is split across eight services, gated behind an application that requires a verified profile at least 60 days old. Reviews and media are still only in the legacy v4 API.
• Features get withdrawn: messaging and call history in 2024, the Q&A API in 2025. Keep anything that matters on infrastructure you control.

THE FOUR SOURCES OF YOUR PROFILE  (only one of them is you)
crawled web content     your site and other public pages
licensed third-party    data feeds Google buys
the public              addresses, phone numbers, photos, reviews
Google itself           its own interactions with the place

THE SIX FIELDS THAT DO THE WORK
name          real-world name only; no taglines, codes, URLs, phone numbers
category      1 primary + up to 9 more; "this business IS a"
address       or hide it and use a service area
hours         plus SPECIAL hours for every public holiday
phone         same number as everywhere else; someone must answer it
website       the location's own page, not the homepage

THE THREE RANKING FACTORS  (Google's words)
relevance   "how well a Business Profile matches what someone is searching for"
distance    "how far each business is from the customer who's searching"
prominence  "how well-known a business is" - links and review count
"There's no way to request or pay for a better local ranking on Google."

"IS IT GOOD FOR SEO?"  - two questions, two answers
local results    YES, and it is a precondition: local results ARE profiles
web results      no documented effect. A Business Profile is not among the
                 ranking systems Google lists in Search Central
the arrow runs   website earns links -> profile gains prominence -> ranks
                 locally.  NOT profile -> website ranks better

DOES MAPS BRING VISITORS?  - mind the word "visitors"
five outcomes    CALL_CLICKS, BUSINESS_DIRECTION_REQUESTS, BUSINESS_BOOKINGS,
                 BUSINESS_FOOD_ORDERS, WEBSITE_CLICKS
only ONE         sends anybody to your website
so               customers can rise while website sessions fall
judge it by      calls, directions and bookings - never by web traffic alone

VERIFICATION
methods       phone or text | email | video recording | live video call
              | mail | instant | bulk
YOU DO NOT CHOOSE  "automatically determined by Google and can't be changed"
review        up to 5 business days
postcard      most codes arrive within 14 days
video         live capture only, unedited, no breaks, 30 seconds minimum
              show location + signage + proof you MANAGE the place
instant       possible when the website is already verified in Search Console
proves        a connection to the location, NOT legal ownership
not permanent name change MIGHT need it again; address move MUST
while waiting do NOT edit name, address or category - the code stops working

EDITS: WHY NOTHING HAS CHANGED YET
every edit    reviewed before it goes live
pending       "usually 10 minutes, but sometimes up to 30 days"
refused       "if it can't confirm its accuracy" - so make it true elsewhere
              first (website, invoices, other directories), then edit here
slowest       name, address, category, phone - the four spam abuses
fastest       photos and posts
service areas up to 48 hours

OWNERSHIP
owner         full control, including adding/removing users and deleting
manager       everything EXCEPT managing users and deleting
primary owner exactly one; needs another owner or manager to hand it to
claimed by
someone else  they are emailed and have 3 DAYS to respond
              no response = you may get the option to claim it yourself

SERVICE AREAS
maximum       20 areas
extent        not more than about 2 hours driving time from the base
hybrid        serves customers AT the address and also travels to them
edits         up to 48 hours to appear

POSTS
types         update | offer (needs dates) | event (needs dates + times)
archived      posts older than 6 months, unless a date range is set
never         a phone number in the post content
hotels        cannot create offer posts at all

READING THE REPORTS
views         UNIQUE PEOPLE, max once per day  (not sessions)
searches      monthly, updated at the start of the month, up to 5 days late
calls         taps on the call button (not calls answered)
directions    direction requests (not arrivals)

THE API FAMILY                              default quota 300 QPM
mybusinessbusinessinformation.googleapis.com  locations, categories, chains
mybusinessaccountmanagement.googleapis.com    accounts, admins, invitations
businessprofileperformance.googleapis.com     daily metrics, monthly keywords
mybusinessverifications.googleapis.com        verification flows
mybusinessnotifications.googleapis.com        Cloud Pub/Sub events
mybusinessplaceactions.googleapis.com         booking and ordering links
mybusinesslodging.googleapis.com              hotel attributes
mybusiness.googleapis.com  (v4, legacy)       REVIEWS and MEDIA live here

BUSINESS INFORMATION API LIMITS
default            300 QPM
create location    300 QPD
searchGoogleLocation 300 QPD
update location  10000 QPD
edits               10 per minute per profile  (CANNOT be increased)

ACCESS
requires      verified, active profile at least 60 DAYS OLD
              a website, and an owner/manager email address
apply via     GBP API contact form, "Application for Basic API Access"
approved?     check the quota: 0 QPM = no, 300 QPM = yes
scope         https://www.googleapis.com/auth/business.manage
two gates     project approved  AND  user is owner/manager of the profile
403 anyway?   Workspace admin has not enabled Business Profile

API POLICIES  (these decide more designs than the quotas do)
storage       "temporarily for no more than 30 calendar days"
no            "pre-fetch, cache, index, or store any content"
so            keep YOUR data and YOUR writes; do not mirror Google's
no automation of review replies, listing edits etc. without the user's
              "prior specific and express consent"
googleLocations  existing clients only. Lead generation =
              "immediate revocation of your API access"
client leaves 7 business days to let them disassociate

MEASURING THE ONE OUTCOME THAT REACHES YOU
tag the profile URL   ?utm_source=google&utm_medium=organic
                      &utm_campaign=gbp&utm_content=<location>
canonical             stays CLEAN - no parameters
check                 redirects preserve the query string

THE KEYWORD THRESHOLD
"value"       the number of unique users that month
"threshold"   the real number is BELOW this - it is not the number
so            never sum this report; count the terms instead

WITHDRAWN  (do not build on what Google hosts for you)
30 Mar 2023   accounts.locations.reportInsights switched off
30 May 2023   My Business Calls API switched off
31 Jul 2024   chat and call history ended
 3 Nov 2025   My Business Q&A API discontinued

PLACE ID
format        ChIJgUbEo8cfqokR5lP9_Wh_DaM
warning       "Place IDs may change over time"
refresh       any ID more than 12 months old
NOT_FOUND     the business closed or moved

Verified August 2026 against support.google.com/business
and developers.google.com/my-business

Read this way, the profile stops being a form you filled in once and becomes what it actually is: a shared record, edited by you, by Google, and by the public, about a real place in the world. And when a shop that has traded on the same corner for thirty years quietly stops appearing for its own category, the cause is almost never the website. It is that somebody suggested an edit, an automated process accepted it, and the profile has been describing the wrong kind of business ever since, to everyone except the owner, who has no reason to search for it.