Analytics, pixels and embeds are held at the network layer until a visitor chooses. Nothing third party reaches the network first.
Free scan · no account · results in about a minute
A script tag is the obvious one and the easy one. The others are what most consent tools miss: a pixel built in JavaScript that is never added to the page, navigator.sendBeacon, which exists specifically to survive a page closing, fetch and XMLHttpRequest to a third-party host, and an iframe whose src the browser starts fetching while the HTML is still being parsed. That last one cannot be stopped in JavaScript at all, because the preload scanner runs before any script does, so embeds are defused server-side before the browser ever reads the page.
Every host the scan found, what it does, and whether it is allowed or held. Nothing is on this list because a vendor told us about it.
The common approach is a banner that shows immediately and a tag manager that fires after a choice. It looks identical to a visitor and is not the same thing at all: the analytics and pixel tags in the page head have already run by the time the banner paints, so the tracking happened and the consent record describes something that did not. Blocking has to be the first thing in the page or it is decoration.
Yes. It is deny by default, so anything third party is held unless a rule allows it. A pixel a marketing agency adds next month is blocked on the day it appears, without anyone updating a list.
YouTube, Vimeo, Spotify and maps are replaced with a placeholder that loads the real embed on click. The iframe src is rewritten before the page reaches the browser, because the preload scanner fetches iframe sources during HTML parsing, before any JavaScript has run.
First-party requests are never touched, and anything categorised as strictly necessary is allowed. What is held is third-party hosts, which is the set that needs consent in the first place.
It is a plain blocking script rather than a deferred one, on purpose. A consent blocker that loads late has already lost, because the trackers it was meant to hold have run. It is about 10KB compressed from a CDN.
Unlimited pages, unlimited visitors, 24 months of consent records in the EU. Less per site as you add more.
Start your free trial