Google tags read the consent state the snippet writes to the shared dataLayer. Before a choice, everything is denied; after a choice, only the granted categories flip to granted.
The plugin prints that default before any Google tag, which is why its head block sits at priority 1.
A scanner can only prove what it can see. This demo sets first-party cookies from the server, writes storage from JavaScript, sends beacons to real endpoints, reads fingerprinting surfaces and calls a CNAME-cloaked subdomain.
Run a scan and the report should read like a site that tracks first and asks later – which is exactly what a real audit finds.
Script tags to known tracker hosts are parked – src removed, type switched to text/plain – and released per category. Programmatic fetch, XHR and sendBeacon calls to those hosts are refused before they leave the browser.
Open the developer tools Network tab, reload, and compare with a visit after accepting everything.