Who Actually Owns Your Website? The Domain, Code and Account Questions to Settle Before You Hire Anyone

Probably not all of it. In Canada, paying for a website does not by itself transfer the copyright in the code and design, because the Copyright Act requires an assignment to be in writing and signed. The domain is a separate question again, governed by whose name sits in the Registrant field. Ownership of a website is really ownership of five separate things, and most contracts settle one of them.

By Cody Wise, founder, Wise Media. Last updated 29 September 2026. This article explains how Canadian copyright law and CIRA’s registry rules apply to a website build. It is not legal advice, and it is not a substitute for advice from counsel on your specific agreement.

Summary

• A website is five assets, not one. The domain name, the hosting environment, the copyright in the custom code and design, the licences to third-party assets, and the accounts. Each transfers differently.
• Paying an invoice is not an assignment. Section 13(4) of the Copyright Act says no assignment is valid unless it is in writing signed by the owner of the right. A paid invoice with no IP clause leaves copyright where it started.
• Your contractor is not your employee. Section 13(3) gives the employer first ownership of work made in the course of employment under a contract of service. An independent agency or freelancer works under a contract for services, which is outside that provision.
• A .ca registration is not property. CIRA’s own General Registration Rules say so in as many words. What you hold is a registration, and what matters is whose name is in the Registrant field.
• No registrar may move your domain over an unpaid bill. CIRA’s rules prohibit a Registrar of Record from transferring a registration or changing the Registrant because of money owed to a registrar or any other third party.
• The lockout is usually an account problem. Analytics, Search Console, the Google Business Profile, the ad accounts and the DNS panel are where most people actually get stuck, and none of them are covered by a copyright clause.

Table of contents

1. What “owning your website” actually means
2. Who owns the domain name?
3. Who owns the code and the design?
4. The five accounts almost nobody transfers
5. The ownership clauses to settle before you sign
6. What to do if you are already locked out
7. Common mistakes
8. Frequently asked questions

What “owning your website” actually means

A website is not a single object you can hold a title to. It is a bundle of five things that live in different places, transfer under different rules, and fail independently of each other. You can own four of the five and still be unable to move your site.

Asset	Where it lives	What decides who holds it	How it transfers
Domain name	A registry (CIRA for .ca, a gTLD registry for .com) through a registrar	Whose legal name is in the Registrant field	A registrant change at the registrar, or a registrar transfer with an authorization code
Hosting and the live environment	A hosting account, plus DNS records	Whose name the hosting account is in, and who controls the DNS zone	Account ownership change, or a migration to a new host
Copyright in custom code, design and copy	Nowhere physical. It is a statutory right	Who authored it, and whether there is a signed written assignment	A signed written assignment, or a licence
Third-party licences	Themes, plugins, fonts, stock photography, icon sets	Whose name the licence was bought in, and what the licence terms permit	Usually not transferable. Often has to be repurchased
Accounts and data	Analytics, Search Console, Google Business Profile, ad accounts, CRM, email	Which Google or platform account holds the owner role	An ownership role grant, then removal of the old owner

The reason this matters commercially is that the five have very different recovery costs. A domain you do not control can usually be recovered. Copyright you never received can be negotiated or, in the worst case, designed around. A Google Business Profile with years of reviews attached to somebody else’s account, or an analytics property with four years of history that gets deleted, is not recoverable at any price. The cheapest asset to secure is the one most people ignore.

Why “we built it, so we own it” is not the whole story either

Agencies are not being unreasonable when they hold accounts. There are real operational reasons: centralised billing on ad accounts, a single maintenance login across a client portfolio, licence keys bought at agency volume that are not assignable per-client. The problem is almost never malice. It is that nobody wrote down what happens at the end, and the end arrives eventually for every engagement.

Who owns the domain name?

Whoever is named in the Registrant field. Not the administrative contact, not the technical contact, not the person whose credit card renews it, and not the person who first suggested the name. If your agency’s company name is in the Registrant field, your agency holds the registration and you do not.

The line most people have never read

For .ca domains, CIRA’s General Registration Rules are blunt about what a domain actually is. Section 8.1 opens with this: “Although a Domain Name Registration is not the property of the Registrant, CIRA will recognize a change to the Registrant associated with a Domain Name Registration.”

Read that twice, because it reframes the whole conversation. A .ca domain is not a thing you own. It is a registration the registry recognises you as holding, subject to rules the registry sets. That is not a technicality. It explains why domain disputes are resolved through registry policy rather than through a property claim, and it is why the Registrant field does all the work.

You also have to be Canadian, or hold a Canadian trademark

A .ca Registrant has to satisfy CIRA’s Canadian Presence Requirements, choosing one of eighteen categories at registration. The common ones are Canadian citizen, permanent resident, a corporation incorporated federally or provincially, and the holder of a trademark registered in Canada. CIRA can ask you to prove the category you selected through its Registrant Information Validation process.

This has a practical consequence that trips up foreign-owned businesses and newly incorporated ones: if the domain was registered under a category that no longer applies, or under an individual who has since left the business, the registration can become awkward to move at exactly the moment you need to move it. Check the category, not just the name.

Nobody can take your domain over an unpaid invoice

This is the scenario people actually write in about. A relationship ends badly, an invoice is disputed, and the client is told the domain is being held until the bill is settled. CIRA’s rules address this directly. Section 4.2(e) of the General Registration Rules states: “Under no circumstances may a Registrar of Record transfer a Domain Name Registration, or change the Registrant associated with a Domain Name Registration due to non-payment by a Registrant of any amounts owed to a Registrar or other third party.”

Note the reach of that wording. It is not limited to money owed to the registrar. It covers amounts owed to any other third party, which includes an agency. If you are the Registrant of record, a registrar cannot lawfully move your registration away from you because someone says you owe them money. The commercial dispute is a commercial dispute, and it gets resolved as one.

The catch is the condition at the front of that sentence. It protects the Registrant. If the agency is the Registrant, this rule does not help you, because nothing is being taken from you. That is the entire reason the Registrant field is the single most important line in this article.

The two timers that will slow you down

• The 60-day lock. CIRA’s transfer guidance states that a domain registered or transferred within the last 60 days cannot be transferred, and that after a completed transfer you cannot transfer again for another 60 days. Plan any registrar move well before a launch date, not during launch week.
• The five-day authorization code. CIRA states that your registrar must provide the authorization code within five days of your request. That is a floor on how fast a transfer can start, and it is worth knowing so that a slow response reads as normal rather than as obstruction.

A registrar transfer typically takes five to seven days end to end. A registrant change, meaning an actual change of owner, is a different process run through the registrar under section 8 of the General Registration Rules, and the incoming registrant has to be an existing CIRA Registrant, satisfy the Canadian Presence Requirements and expressly agree to the Registrant Agreement. Do not assume the two are the same transaction, because agreeing to “transfer the domain” without specifying which one is how people end up at a new registrar with the old owner still in the Registrant field.

Who owns the code and the design?

The author owns it until there is a signed written assignment. Section 13(1) of the Copyright Act says “the author of a work shall be the first owner of the copyright therein.” For a website, the authors are the people who wrote the code, drew the layouts and wrote the copy. Unless something moved the right, it sits with them or with their firm.

The employment carve-out does not cover contractors

Section 13(3) is the exception people half-remember. It provides that where the author “was in the employment of some other person under a contract of service or apprenticeship and the work was made in the course of his employment”, the employer is first owner, absent an agreement to the contrary.

The operative phrase is “contract of service”, which in Canadian law means employment. An independent agency, a freelancer or a studio works under a contract for services, which is a different thing. Whether a particular person is an employee or a contractor is a fact-specific question that turns on control, tools, risk and integration, and it is not decided by what the invoice is titled. But the default posture for a normal agency engagement is clear enough: section 13(3) is not doing the work you might hope it is doing.

Section 13(4) is the sentence that decides most disputes

Section 13(4) provides that the owner may assign the right wholly or partially, “but no assignment or grant is valid unless it is in writing signed by the owner of the right in respect of which the assignment or grant is made, or by the owner’s duly authorized agent.”

In writing. Signed. By the owner. A paid invoice is not that. A statement of work that says “deliverables” is not that. An email saying “it’s all yours” is closer but is not the same as an assignment clause, and you do not want to find out how much closer in front of a judge. If your contract has no clause that assigns copyright to you, the safe assumption is that you have an implied licence to use what you paid for and nothing more, and the scope of an implied licence is exactly the thing that gets argued about when the relationship sours.

The 25-year clock nobody mentions

Even a clean assignment has a ceiling when the assignor is the author. Section 14(1) of the Copyright Act provides that no assignment made otherwise than by will is operative to vest in the assignee any rights beyond twenty-five years from the death of the author, at which point the reversionary interest devolves on the author’s legal representatives as part of the estate. Copyright in Canada runs for the life of the author plus seventy years, so an assignment by an individual author reaches only twenty-five of those seventy post-death years.

Keep this in proportion. Section 14(2) excludes collective works, and the provision does not reach works that an employer owned from the start under section 13(3), so a corporately owned agency deliverable is usually outside it. It is also a very long horizon for a website, which has a practical life measured in years rather than decades. But it is a real limit, it is one of the better arguments for registering a trademark rather than treating copyright as the durable brand right, and it is a reason to make sure the assignment in your contract comes from the corporate entity rather than from a named individual where that is possible.

We covered the brand-mark side of this in detail in our guide to who owns your logo copyright in Canada, and the same statutory mechanics apply to a website’s design files.

WordPress, the GPL, and what you cannot be denied

If your site runs on WordPress, part of the stack is already settled. WordPress core is distributed under the GNU General Public License, and themes and plugins that derive from it inherit that licensing posture. In practice that means the PHP in a custom theme built on WordPress is not something an agency can lock you out of on licensing grounds. What is not automatically covered by the GPL is the part that usually matters to a business: the design files, the images, the copy, and in many commercial products the CSS and JavaScript, which vendors frequently licence separately under a split-licence arrangement.

So the GPL protects your ability to keep running and modifying the site. It does not give you the brand assets. Do not let a “it’s WordPress, it’s open source” answer stand in for an assignment clause.

The licences that do not travel

Third-party assets are where a clean handover quietly becomes an expensive one. Check all of these before you assume the site is portable:

• Premium theme and plugin licences. Often registered to the agency’s account, frequently sold per-site, and in many cases carrying an update entitlement tied to a purchase token rather than to you.
• Page builder licences. Same problem, higher stakes, because losing updates on a builder eventually breaks the editing experience rather than just the plugin.
• Fonts. The most common quiet breach on the internet. A desktop font licence does not include webfont embedding, and a webfont licence is usually capped by monthly pageviews and is almost never transferable between entities.
• Stock photography and icons. Standard licences name a licensee. If that licensee is the agency, your continued use after the relationship ends is not covered.
• Custom illustration and photography. Same copyright analysis as the code. If a photographer shot your team, the photographer is the author.

Ask for a written asset inventory listing every paid licence, who it is registered to, and whether it is transferable. A good agency will already have one. If nobody can produce it, that is your answer about how the handover will go.

The five accounts almost nobody transfers

In practice, most people who feel locked out of their own website are not fighting about copyright. They are fighting about a login. Accounts are the cheapest thing on this list to secure and the most expensive to lose, because the value is the history inside them and history cannot be rebuilt.

Account	What you lose if it stays with the agency	Recoverable?
Google Analytics 4 property	All historical traffic, conversion and audience data	No. A new property starts empty
Google Search Console property	Query history, index coverage history, manual action notices	Partly. You can re-verify, but historical data does not backfill
Google Business Profile	Reviews, photos, posts, and the verified listing itself	Slow. Google has an ownership request process and it is not fast
Google Ads and Meta Ads accounts	Conversion history, audiences, learning phase, and the ad account’s own age	Partly. Assets can sometimes be shared, learning cannot
Domain registrar and DNS panel	Control of where the domain points, and of email routing	Yes, via the registrant and registrar processes above

The rule that solves all five is simple, and it is worth insisting on at kickoff rather than at exit. You create the accounts under your own organisation identity. You grant the agency an admin or manager role. You never accept a setup where the agency’s account is the owner and you are a user on it. This costs nothing on day one and is close to unfixable on day four hundred.

A second rule worth adopting: use a shared business identity for these, not a personal one. A property owned by the marketing coordinator who left in March is the same lockout with a friendlier name on it.

Do not forget the email and the DNS zone

DNS is the most dangerous item on the whole list, because it controls both the website and the company email. If the agency runs your DNS zone at their registrar or their CDN account, then a bad exit does not just take down a marketing page. It takes down mail routing for the business. If you do nothing else after reading this, find out today who controls your DNS and whether you have a login to it.

The ownership clauses to settle before you sign

This is the whole article compressed into something you can raise in a sales conversation without sounding adversarial. A competent agency will not flinch at any of it, because a competent agency has already written it down.

1. An assignment clause, not a “you may use it” clause. It should say that on final payment, the agency assigns to you all copyright in the deliverables created specifically for you, in writing, signed. Watch for the difference between an assignment and a perpetual licence. A licence can carry conditions.
2. A carve-out you should expect and accept. Agencies reasonably retain rights in their own pre-existing tools, frameworks, component libraries and internal code. What you want is a licence to keep using those in your site, in perpetuity, without further payment. That is a fair trade and a reasonable agency will agree to it.
3. Named registrant. The contract should state, in words, that the domain is registered with your legal entity in the Registrant field, and that the agency is at most a technical or administrative contact.
4. Named account owner. Same again for analytics, Search Console, the Google Business Profile and any ad accounts. Ownership yours, access theirs.
5. A handover schedule. A written list of what is delivered at the end: source files, database export, credentials, the asset licence inventory, and a deadline measured in business days.
6. Moral rights waiver. Canadian authors hold moral rights separately from copyright, and those cannot be assigned, only waived. Without a waiver, a modification to the work can in principle become an issue. Ask for the waiver in the same clause as the assignment.
7. What happens on non-payment. Be fair about this one. It is entirely legitimate for an agency to say that the assignment takes effect on final payment. What is not legitimate is a term that lets them take the domain or delete the site. Agree the remedy in advance and you will never have to argue about it.

If you are still shortlisting, these questions belong in the same conversation as budget and timeline. We set out the rest of that conversation in how to choose a web design agency in Canada.

What to do if you are already locked out

Start by establishing one fact, because it determines everything else: are you the Registrant of the domain? Look it up in a public WHOIS or RDAP lookup before you send a single email. For .ca domains, CIRA runs a public WHOIS, and personal registrant information is withheld for individuals while organisational registrants are displayed.

If you are the Registrant

1. Recover access to the registrar account directly, using the registrant email on file. If that email is one you no longer control, the registrar has an identity verification process. Use it.
2. Request the authorization code. CIRA states the registrar must provide it within five days.
3. Move the domain to a registrar account in your own name, then check the 60-day timers before you plan anything time-sensitive.
4. Repoint DNS only once you have a working destination ready. Do not repoint first and build second.
5. If a registrar tells you the domain is being withheld because money is owed to a third party, quote section 4.2(e) of the General Registration Rules back to them and escalate to CIRA.

If the agency is the Registrant

You are in a commercial negotiation rather than a technical process, and you should approach it that way. Ask for a registrant change in writing, specifying that you mean a change of Registrant and not merely a registrar transfer. Most of these resolve in a week because most agencies are not trying to hold anything.

If it does not resolve, there is a registry-level route worth knowing about. CIRA’s Domain Name Dispute Resolution Policy, version 1.3 dated 22 August 2011, lets a complainant seek transfer or deletion of a .ca registration. Under paragraph 4.1 the complainant must prove, on a balance of probabilities, that the domain is confusingly similar to a Mark in which the complainant had Rights before the registration date, that the registrant registered it in bad faith as described in paragraph 3.5, and that the registrant has no legitimate interest as defined in paragraph 3.4. Under paragraph 4.3 a successful panel decision results in the registration being deleted or transferred to the complainant.

Read the bad faith requirement carefully before you build hope on this. A domain registered by an agency in the ordinary course of doing work for you, with your knowledge, is a poor fit for a bad-faith finding. The CDRP is built for cybersquatting, not for a handover that went cold. A contract claim is usually the stronger route, and a lawyer’s letter that quotes your own agreement usually moves faster than either.

If you cannot get the site files

You have more options than people assume. A public site can be crawled and its content preserved. A WordPress site you still have an admin login to can be exported, database and uploads included, in under an hour. And in a meaningful number of cases the honest answer is that the site was three years old, was going to be rebuilt anyway, and fighting for the files costs more than replacing them. Price the fight against the rebuild before you commit to the fight. Our notes on migrating a site between platforms cover what actually has to move and what does not.

What you cannot rebuild is the domain and the review history. Spend your energy there.

Common mistakes

• Assuming the invoice transferred the copyright. Section 13(4) requires a signed writing. The invoice is evidence of payment, not of assignment.
• Confusing the admin contact with the Registrant. Being listed as the administrative contact feels like ownership and is not. Check the Registrant field specifically.
• Letting the agency create the Google accounts. The single most common and most costly mistake on this list, and the easiest to avoid at kickoff.
• Registering the domain in a personal name. Fine on day one, painful at a sale, a financing, a partner exit or a death. Put it in the corporate entity.
• Letting the agency hold the DNS zone. It puts company email in the blast radius of a marketing dispute.
• Taking a verbal assurance on font and stock licences. Ask for the inventory in writing. Font licensing in particular is breached far more often than it is enforced, which is not the same as being fine.
• Waiting until the relationship is ending to ask any of this. Every question in this article is easy to ask at kickoff and adversarial to ask at exit.

Agency-held versus client-held: an honest comparison

	Agency holds the accounts	Client holds the accounts
Speed of day-to-day work	Faster. No access requests, no waiting	Slightly slower at setup, identical afterwards
Billing simplicity	Consolidated, often with agency-rate licences	You pay platforms directly, which is more transparent
Exit risk	High. This is the entire problem	Low. You revoke a role
Continuity of data	At risk if the agency closes or is acquired	Yours regardless
Business valuation	A diligence flag in any sale or raise	Clean

The honest read is that agency-held accounts are genuinely more convenient and that the convenience is real for both sides. It is simply not worth what it costs the one time it goes wrong. Grant access, do not surrender ownership, and the convenience gap turns out to be about fifteen minutes total.

The twenty-minute ownership audit

Run this today, whether or not anything is wrong. Write the answers down. Nine out of ten businesses find at least one item they cannot answer.

• Look up your domain in a public WHOIS or RDAP tool. Whose legal name is in the Registrant field?
• Can you log in to the registrar account yourself, right now, without asking anyone?
• What is the domain’s expiry date, and is auto-renew on, against a payment method that has not expired?
• Who controls the DNS zone, and can you log in to it?
• Is your company email routed through that same DNS zone?
• Whose account owns the hosting, and do you have a billing login?
• Open Google Analytics. Are you listed with the Administrator role on the property, or only as a viewer?
• Open Search Console. Are you a verified owner, or a delegated user?
• Open your Google Business Profile. Are you the primary owner?
• Open each ad account. Are you the owner of the account, or a user inside someone else’s business manager?
• Do you have a copy of your contract, and does it contain the word “assign”?
• Do you have a written inventory of paid themes, plugins, fonts and stock licences, and whose name they are in?
• Do you hold a current backup of the site files and database, stored somewhere you control?

Every item you cannot answer is a dependency on somebody else’s goodwill. Goodwill is a fine thing to have and a poor thing to rely on.

Frequently asked questions

If I paid for my website, do I own it?

Not automatically. Section 13(1) of the Copyright Act makes the author the first owner, and section 13(4) says no assignment is valid unless it is in writing signed by the owner of the right. Payment on its own does not satisfy that. What payment usually gives you is an implied licence to use the work for the purpose it was made for, which is narrower than ownership and less certain in scope.

Can my web designer hold my domain hostage over an unpaid invoice?

If you are the Registrant, no registrar may act on that demand. CIRA’s General Registration Rules, section 4.2(e), prohibit a Registrar of Record from transferring a registration or changing the Registrant due to non-payment of amounts owed to a registrar or any other third party. If the designer is the Registrant, the rule does not assist you, and you are in a contractual dispute rather than a registry one.

Is a .ca domain something I own?

Not in the property sense. CIRA’s General Registration Rules state at section 8.1 that a Domain Name Registration is not the property of the Registrant, while confirming that CIRA will recognise a change of Registrant. You hold a registration, subject to registry rules and to the Canadian Presence Requirements.

How long does it take to move a .ca domain?

CIRA states that a registrar transfer typically takes five to seven days, that your current registrar must supply the authorization code within five days of your request, and that a domain registered or transferred in the last 60 days cannot be transferred. After a completed transfer there is a further 60-day wait before it can move again.

Does the GPL mean I own my WordPress site?

It means the WordPress-derived code cannot be locked away from you on licensing grounds, which is genuinely useful. It does not transfer copyright in the design files, the photography, the copy, or in commercial assets that vendors licence separately. Treat the GPL as protecting your ability to keep operating, not as a substitute for an assignment clause.

What should I put in a contract to avoid all of this?

Four clauses cover most of it: a written assignment of copyright in the bespoke deliverables on final payment, a perpetual licence to any pre-existing agency tools embedded in your site, a statement that the domain is registered in your legal entity’s name, and a statement that you own the analytics, Search Console, Business Profile and ad accounts while the agency holds access. Add a moral rights waiver and a handover schedule with a deadline in business days.

My agency created my Google Business Profile. Can I get it back?

Usually, but not quickly. Google has an ownership request process for claiming a profile held by another account, and it runs on Google’s timeline rather than yours. Ask for a voluntary primary-owner transfer first, in writing, because that takes minutes and the alternative takes weeks.

Is any of this different for a .com?

The copyright analysis is identical, because that is federal statute and has nothing to do with the domain. The domain mechanics differ: .com falls under ICANN’s transfer policy rather than CIRA’s rules, there is no Canadian presence requirement, and disputes run through the UDRP rather than the CDRP. The core advice does not change. Check the Registrant field.

The short version

Ownership of a website is five separate questions wearing one coat. The copyright question is settled by a signed writing and nothing else. The domain question is settled by one field in a registry record. The account question is settled at kickoff, by whoever clicks “create” first, and it is the one that costs the most to get wrong.

None of this requires an adversarial relationship with whoever builds your site. It requires the terms to be written down while everybody is still getting along. If you are not sure what your current arrangement says, the audit above will tell you in twenty minutes, and it is a better use of those twenty minutes than almost anything else on your list this week.

Get your ownership sorted before the next build

Every Wise Media build ships with the domain in your name, the accounts under your organisation, and a written assignment of the work we create for you. It is not a premium add-on. It is the only sane way to hand over a business asset. If you are planning a new site, or you have just discovered that you cannot answer half the audit above, we can start with an access and ownership review before anybody writes a line of code.

See our website packages for what a build includes, or tell us about your project through our intake form and we will come back with a scoped recommendation. If your current site is running but nobody is looking after it, our guide to what a WordPress maintenance plan should include is the right place to start instead.