CSP violations are reported to a third party

A Content Security Policy can tell the browser where to report violations. Services such as report-uri.com, Sentry or Datadog receive and analyse these reports — that is useful and part of a well-kept policy. But every report carries the visited URL, the referrer, the user agent and, as the sender, the visitor's IP address.

The service thereby processes personal data on your behalf. That is not a violation, but an obligation: it belongs in the privacy policy, and it needs a data processing agreement — for providers outside the EU additionally a basis for the third-country transfer. Most services have the agreements ready; they just need to be signed. Technical assessment, not legal advice.

Check it yourself: open the response headers of the start page in the browser (network tab), look for `report-uri` or `report-to` in the `Content-Security-Policy` header and compare the host with your own domain.