Google Analytics 4
Checked against the official docs on 2026-10-28. Official documentation (opens in a new tab)
Check Google Analytics 4 against my policy
With advertising features (Google Signals, remarketing), Google also asks to list https://*.google.<TLD> for every country domain your visitors use (google.fr, google.de, …). Those country domains are not checked here.
The safer option: nonces
When loaded through Google Tag Manager or the Google tag with a nonce, the nonce is passed on.
Measurement (without advertising features)
script-src https://www.googletagmanager.com;
img-src https://www.googletagmanager.com https://*.google-analytics.com;
connect-src https://www.googletagmanager.com https://*.google-analytics.com https://*.google.com;| Content | Allowed source | Why |
|---|---|---|
| Scripts | https://www.googletagmanager.com | Loads the Google tag (gtag.js). |
| Images | https://www.googletagmanager.comhttps://*.google-analytics.com | Sends hits as image pixels. |
| Data connections | https://www.googletagmanager.comhttps://*.google-analytics.comhttps://*.google.com | Sends hits to the collection servers. |
Advertising features (Google Signals, remarketing)
img-src https://*.google.com https://*.g.doubleclick.net;
connect-src https://*.g.doubleclick.net https://pagead2.googlesyndication.com;
frame-src https://www.googletagmanager.com;| Content | Allowed source | Why |
|---|---|---|
| Images | https://*.google.comhttps://*.g.doubleclick.net | Ads-related pixels. |
| Data connections | https://*.g.doubleclick.nethttps://pagead2.googlesyndication.com | Ads-related requests. |
| Embedded frames | https://www.googletagmanager.com | Ads-related frame. |
Something changed? Report an outdated entry (opens in a new tab).