---
description: How to run Google Tag Manager under a Content Security Policy using nonces, and how to send CSP violation reports to Report URI.
---

# Google Tag Manager

Google Tag Manager is one of the most common reasons a CSP rollout stalls. The container script is inline, every tag you deploy through it can inject more script, and the set of domains involved depends on which Google products you have turned on.

Google's own guidance is clear about the order of preference: use a nonce, fall back to hashing the inline script, and treat `'unsafe-inline'` as a last resort.

## What Google Tag Manager gives you

- Nonce support on the container snippet. Generate a nonce server-side for each response, put it in your `script-src-elem` directive, and add the matching `nonce` attribute to the Tag Manager script tag.
- Hashing the inline container snippet as an alternative where you cannot generate a per-response nonce.
- Per-product domain guidance rather than one list, because the domains differ by product: GA4 needs `google-analytics.com`, `g.doubleclick.net` and Google regional domains; Google Ads needs `googleadservices.com`, `doubleclick.net` and the syndication domains; Floodlight uses `ad.doubleclick.net` and advertiser-specific endpoints.
- Custom templates, which are the safe way to extend functionality. Custom JavaScript variables require `'unsafe-eval'`, which Google explicitly discourages.
- Tag Assistant for identifying blocked resources while you tune.

## Sending reports to Report URI

Add a reporting directive to whatever policy you are already serving. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src-elem 'nonce-{random}'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Your CSP reports are the fastest inventory of what your container is actually loading - including tags somebody added months ago and forgot about.

## Things to watch for

- A nonce is only a nonce if it is unguessable and regenerated for every response. A nonce baked into a cached page is worth nothing.
- Tag Manager is a delegation of trust: anyone with publish rights in the container can add a script to your pages without touching your codebase. That is exactly the change [Policy Watch](/setup/policy-watch/) and [Script Watch](/setup/script-watch/) are designed to surface.
- Adding domains to your policy one violation at a time works, but it quietly grows an allowlist you will never prune. Review it periodically.

## Official documentation

[Google - Use a Content Security Policy](https://developers.google.com/tag-platform/security/guides/csp)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)