firebasegoogle-analyticsgoogle-analytics-apifirebase-analyticsweb-analytics

Harm caused to sensitive data by exposing Google Analytics Tag

I am trying to add a google analytics tag to my portfolio page which is public on GitHub. Is it possible for someone to access the sensitive analytical data just by knowing the Measurement ID and the link to the GTag script?

The following is the snippet of code that would appear to the user who finds my repository.

<script async src="https://www.googletagmanager.com/gtag/js?id=G-*****"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());

      gtag('config', 'G-*****');
    </script>
Solution

  • That ID in the gtag include just identifies your Analytics project/property on Google's servers. You need to know that ID to report analytics events for that project/property, but on its own it is not enough to then also access somebody else's or aggregated analytics data.