Keep executable loaders inactive
A script that exists in the document has already been fetched and, in most cases, already run. Anything done to it afterwards is cleanup. Real blocking means the element is never created until the category is granted, which is why StrongPrivacy models gated technologies as declarations the runtime materialises on grant, rather than as tags it disables.
- Registering a script with the browser API keeps it inert until its category is allowed
- Custom scripts are declared as an HTTPS URL and a purpose, never as inline markup that already ran
- On withdrawal, stop future loading and use vendor teardown or revoke APIs and storage cleanup where supported; removing an element or reloading does not by itself erase every client- or server-side identifier
- Vendors with a consent signal get denied defaults set before their container loads
What blocking cannot reach
Anything not in the page is not in scope
Server-side integrations, app-embedded SDKs, tags injected by a platform you do not control, and vendor-side identity resolution all continue regardless. They need to be found and handled separately, which is what an investigation from a real HAR capture is for.
Common questions
Is changing a script type to text/plain good enough?
It can be legitimate if the browser receives an inert tag, no other loader activates it, and the implementation creates or executes it only after the applicable choice. It is a fragile retrofit and does not control scripts injected through other paths. Not creating the executable element until grant is usually easier to verify.
How do I prove blocking works?
Scan in a real browser in each state (before consent, after rejection, after approval) and compare what loaded. Source inspection will not tell you what executed.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- ICO: guidance on storage and access technologies
Regulator guidance
Checked
- StrongPrivacy custom-site installation guide
Product documentation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.