CSP blocks ga-audiences pixel for non-US visitors

Feedback
1

Noticed a recurring CSP violation on every notebook page load:

The GA4 tag (G-9B88TP6PKQ) has Google Signals enabled, so the collect call redirects to the ga-audiences remarketing pixel. Google serves that pixel from the visitor’s local ccTLD — I’m in Belgium and get www.google.nl. The img-src directive only allows the literal host https://www.google.com/ads/ga-audiences, so it’s blocked for everyone outside the US.

Nothing breaks, but the console fills up, and the audience sync is presumably failing silently for a big chunk of your traffic.

CSP has no wildcard for the TLD position, so the fix is either enumerating Google’s regional domains in img-src, disabling Google Signals on the property, or moving to server-side tagging.

Can someone on the web team take a look?

2

Thanks for the report, and sorry for the console spam.

It’s crazy to me that Google expects you to add dozens of origins to your CSP (and presumably that list can change over time!) to get their analytics to work.

I don’t see it being practical for us to allow all these origins. Nor do I expect us to write some client-side script to patch their software to route it through google .com as I see other people doing… perhaps we’ll remove it entirely.

3

Thanks for the swift reply. I now understand that this is caused by Google instead of Observablehq, and agree with your line of thought.