Comment by fny

Couldn't one circumvent CSP by sending the data to a legitimate analytics service that everyone uses like Google Analytics?