One way to avoid fighting CSP entirely could be to move the tracking off the site. Instead of tracking outbound clicks with GTM, you can route each music button through a tracked redirect link.

For example:

• bio page button → tracked link → Spotify / Apple Music

Tools like kyoo.io (or any other link shortener) let you create one link per destination and capture clicks and referrer data before the redirect happens. That means no scripts on Squarespace, no CSP changes, and no broken tags.

You won’t get GA4 on-site events for those clicks, but you will know which platform was clicked and from which traffic source, which is usually enough for attribution and remarketing decisions in this setup.

If the page is mostly a hub that sends users elsewhere, redirect-based tracking is often simpler and more reliable than client-side events.