Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
Google is sunsetting Universal Analytics (GA3) at the end of June 2024.
The new version of analytics, GA4, recommends the use of Google Tag Manager. This is a functionality provided by Google, whereby arbitrary code may be entered into the Google Analytics console and then injected into a script on the application page.
The Google Tag Manager process bypasses Pay's secure development requirements (prioritisation, code written by trained software developers, code review and security testing) and is therefore not acceptable for use in any applications in the card data environment (CDE) or any applications that affect the CDE, as our PCI compliance would be at risk.
Google tag ('gtag') may be used as a static alternative to Google Tag Manager (see Google's documentation for more information about the difference between the two). This method does not include any code modifiable in the console and as such is suitable for use by GOV.UK Pay.
Changes proposed in this pull request
Implementation of gtag and removal of GA code.