No nonce and no hashes: scripts are judged by host. The policy lists every source the Google definitions' csp rows give (feature rows included, country domains expanded); 'unsafe-inline' allows the inline snippet. GA4 (direct gtag.js) fires. Expect no csp_policy_blocks_tag_requirements and no csp_blocks_tracker_scripts for a Google tag.