Google Ads
Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)
Check Google Ads against my policy
Google also asks to list https://www.google.<TLD> for every country domain your visitors use. Those country domains are not checked here.
The safer option: nonces
When loaded through Google Tag Manager or the Google tag with a nonce, the nonce is passed on.
Conversion tracking, remarketing and conversion linker
script-src https://www.googletagmanager.com https://www.googleadservices.com https://www.google.com;
img-src https://www.googletagmanager.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://pagead2.googlesyndication.com https://www.google.com;
connect-src https://www.googletagmanager.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://pagead2.googlesyndication.com https://www.google.com https://ad.doubleclick.net;
frame-src https://www.googletagmanager.com;| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://www.googletagmanager.comhttps://www.googleadservices.comhttps://www.google.com | Loads the conversion and remarketing scripts. |
| Images | https://www.googletagmanager.comhttps://www.googleadservices.comhttps://googleads.g.doubleclick.nethttps://pagead2.googlesyndication.comhttps://www.google.com | Sends conversions as image pixels. |
| Data connections | https://www.googletagmanager.comhttps://www.googleadservices.comhttps://googleads.g.doubleclick.nethttps://pagead2.googlesyndication.comhttps://www.google.comhttps://ad.doubleclick.net | Sends conversions to Google's servers. |
| Embedded frames | https://www.googletagmanager.com | Remarketing frame. |
Floodlight (Campaign Manager 360)
img-src https://www.googletagmanager.com https://ad.doubleclick.net https://ade.googlesyndication.com https://adservice.google.com;
connect-src https://pagead2.googlesyndication.com https://www.google.com https://www.googleadservices.com https://ad.doubleclick.net;
frame-src https://www.googletagmanager.com https://*.fls.doubleclick.net;| Content | Allowed source | Why |
|---|---|---|
| Images | https://www.googletagmanager.comhttps://ad.doubleclick.nethttps://ade.googlesyndication.comhttps://adservice.google.com | Floodlight pixels. |
| Data connections | https://pagead2.googlesyndication.comhttps://www.google.comhttps://www.googleadservices.comhttps://ad.doubleclick.net | Floodlight requests. |
| Embedded frames | https://www.googletagmanager.comhttps://*.fls.doubleclick.net | Floodlight frames (the second one only for custom scripts). |
Something changed? Report an outdated entry (opens in a new tab).