Is there any problem with moving GA4 tracking code to a file on my own domain, and updating the file contents daily?

Question

I have a site that I intentionally set up with a very strict CSP, such that inline scripts won't work.

Additionally, any 3rd party scripts require a subresource integrity hash, to ensure the 3rd party can't change the code. The only issue there is the GA4 tracking script gets updated by Google as they make updates to the GA product, so the SRI hash won't work.

My workaround has been to copy the contents of that js file that lives on https://www.googletagmanager.com/gtag/js?id=ACCOUNT-ID into a file on my own domain, e.g:

<script async src="{% static 'google-tracking.js' %}"></script>

And it appears to be sending data into my GA4 dashboard properly.

I haven't gotten around to this yet, but knowing that this tracking code is updated regularly, I plan to run a chronjob daily to replace the contents of the js file on my site with the contents of https://www.googletagmanager.com/gtag/js?id=ACCOUNT-ID.

I haven't done that yet and it still works, but I will do this to ensure it keeps working.

What I've done sounds to me like a non-standard implementation of GA tracking, and I'm wondering if anyone has dealt with this before, if there are any problems with doing it this way. Thank you for your time.

Answer 1

I thought of a very similar solution as an ok way of going around super strict CSPs. Or even speeding up page load. I really just see two concerns here:

Having a cron job for updating the analytics script seems like an overkill. But yes, in case they update the measurement protocol for GA4, that will be helpful.

GTM would be much more preferable unless this is a tiny site not worth analyzing we're talking about, in which case, why bother with super strict CSP? I would go for normal CSP + GTM.