What is Content Security Policy (CSP)?

CSP is a real security control, not a GA4 or GTM setting. It's set by whoever controls your web server, CDN, or reverse proxy (Cloudflare, Vercel, Nginx, a WordPress security plugin), usually as a Content-Security-Policy response header. It exists to stop cross-site scripting attacks by refusing to run any script the policy doesn't explicitly name. Analytics tags are, from the browser's point of view, exactly the kind of third-party script CSP is designed to block, so a policy written without analytics in mind takes GA4 and GTM down with it.

Where to find it:

There's no CSP setting inside GA4 or GTM; you won't find it in either product's admin. The place it actually surfaces is your browser's console: DevTools > Console, filtered for "Refused to load" or "violates the following Content Security Policy directive." If your developers manage the header themselves, it usually lives in server config or CDN edge rules, not application code.

Why it matters:

Two distinct failures come from the same root cause:

1. The tag goes fully dark, silently. If the CSP's script-src and connect-src directives don't include www.googletagmanager.com and www.google-analytics.com, the browser refuses to run the tag or blocks its outgoing beacon to google-analytics.com/g/collect. There's no user-facing error, just a console warning almost nobody checks, so a property can go dark for weeks before anyone in marketing asks why traffic dropped to zero after the last deploy.
2. Debugging itself gets blocked. The same policy can separately block tagassistant.google.com, the domain GTM's Preview mode and the Tag Assistant Companion extension connect through. The debug panel won't even open, and a developer burns time suspecting GTM when the actual blocker is the site's own CSP.

Example: A team migrates to a stricter CDN security layer. The new policy allows *.googletagmanager.com under script-src, so the GTM container itself loads fine and nothing looks visibly broken. But connect-src was never updated, so every gtag() call's outgoing request to google-analytics.com/g/collect is silently blocked. DebugView shows nothing. Tag Assistant shows nothing. The fix is a single missing directive.

If a property that was tracking fine suddenly shows zero data right after a deployment, checking the console for CSP violations is one of the fastest ways to confirm or rule out the cause before assuming GA4 or GTM itself broke. The debugging side of this problem is covered in GTM Preview Mode Not Working? Every Fix in One Place (see "Problem 7"), and the tracking-outage side in GA4 Not Tracking? The Complete Troubleshooting Checklist.