First-party tracking domain

Why this matters

Ad blockers mostly work from lists of third-party domains. A request to an analytics vendor's domain is easy to spot and block; a request to dataopenapi.yoursite.com is not, because from the browser's point of view it is first-party — the same origin as the page itself.

In practice this recovers roughly 10–30% of traffic, depending on your audience. Technical and privacy-conscious audiences sit at the top of that range.

This also covers the tracking script itself, not just the measurement requests. Blockers filter oa.js by URL as well, so we serve it from your domain too.

What you need

• A domain you already use for your site.
• Access to its DNS records.
• A subdomain dedicated to measurement. It must start with dataopenapi. — for example dataopenapi.yoursite.com. Our routing identifies measurement traffic by that prefix, so a subdomain named anything else never reaches us.

It has to be a subdomain. DNS does not permit CNAME records on a bare domain (yoursite.com), so use dataopenapi.yoursite.com instead.

Setting it up

1. In the console, open your project and go to Tracking domain. Enter the subdomain you want to use and save it.
2. Add the CNAME record shown there at your DNS provider. It looks like this:

   Type	CNAME
   Name	dataopenapi.yoursite.com
   Value	ingest.openanalyticsapi.com

3. Once the record is live, press Verify DNS. Propagation takes anywhere from a couple of minutes to a few hours depending on your provider's TTL.
4. We issue a TLS certificate for your subdomain and activate it. This step is currently manual on our side and takes up to 24 hours. You do not need to do anything while it runs.
5. When the domain shows as Active, the console gives you a ready-made snippet. Replace your existing one with it.

The snippet

Compared to the standard snippet, both the script URL and data-api point at your own domain:

<script async defer
  src="https://dataopenapi.yoursite.com/oa.js"
  data-site="YOUR_SITE_ID"
  data-api="https://dataopenapi.yoursite.com"></script>

The replay and heatmap add-ons work the same way — point their src at your domain as well.

Good to know

• Nothing else is exposed on that subdomain. It answers only for the tracking scripts and the measurement endpoints. Everything else returns 404.
• Historical data is unaffected. The site ID does not change, so switching over does not split your reporting.
• You can switch back at any time by restoring the standard snippet. Remove the domain in the console afterwards.
• This is not a way around consent. First-party delivery changes how requests are routed, not what you are allowed to collect — your cookie and consent obligations are unchanged. See GDPR & Privacy.
• Certificate renewals are handled by us for as long as the CNAME keeps pointing at us. If you remove the record, the certificate lapses and measurement on that domain stops.