Osano CMP Blocking in Browser

Browser Blocking Behavior
Seeing a script file appear in the Network tab does not mean the script ran. Osano CMP can block a script from executing even when the browser has already downloaded the file from the vendor.
The two things to understand:

1. The browser's preload scanner can fetch a script file before any JavaScript, including Osano's, has had a chance to intervene.

2. To prevent execution, Osano rewrites the script's type attribute to osano/blocked. This leverages a behavior defined in the HTML specification: browsers will only execute <script> elements whose type is a valid JavaScript MIME type. Any other value, including osano/blocked, causes the browser to treat the element as inert.

The Network tab shows what was fetched. It does not show what was executed.

Why the file still gets downloaded
When a browser parses an HTML document and encounters a <script src="..."> tag, its preload scanner may begin the network fetch in parallel with parsing — before any JavaScript on the page has run. By the time Osano's MutationObserver callback fires on the newly inserted script element, the request has often already been initiated or completed.

This is a property of how modern browsers optimize page load. Osano cannot retroactively cancel an in-flight fetch. What Osano can do is intervene before the browser's HTML parser hands the script element off to the JavaScript engine for execution.

It is also worth noting that even if Osano could remove the src attribute outright, doing so would cause two problems:

• Inline scripts that hold a reference to the element (e.g., document.getElementById('gtm').src) would break.

• If the visitor later grants consent, Osano would have to force a fresh download rather than simply re-enabling the script that is already cached.

For these reasons, modifying type rather than removing src is the standard pattern used by Osano and by most consent management platforms.

How to verify a script is not running
Inspecting the Network tab alone is not sufficient. To confirm a script has been blocked from executing, use one of the following:

• Inspect the DOM In the Elements panel of developer tools, locate the script tag. If it shows type="osano/blocked", the browser is not executing it.

• Run a console query Paste this into the browser console to list every script Osano has blocked on the current page:

document.querySelectorAll('script[type="osano/blocked"]')

Use the official event listener Osano CMP fires an osano-cm-script-blocked event whenever a script is blocked. Add the following to your page (after the Osano CMP script) to log everything Osano blocks:

window.Osano.cm.addEventListener("osano-cm-script-blocked", function (src) {
  console.log("Osano blocked script:", src);
});

Note: The callback receives the blocked script's URL as a string (e.g. "https://example.com/tag.js"), not a DOM event object.

Check for side effects The definitive test is whether the script's side effects occurred. For an analytics or marketing tag, that means checking whether:

• the vendor's tracking beacon or pixel went out (search the Network tab for the vendor's collection endpoint, not the script file)

• the vendor's global variables exist (e.g., window.dataLayer, window.fbq, window.gtag)

• the vendor's cookies have been set

If none of those are present, the script did not run, regardless of whether the .js file appears in the Network tab.

What Osano cannot block this way
For completeness, the type-rewrite mechanism only applies to scripts loaded into the page that Osano can see. There are categories of trackers Osano cannot intercept this way:

• Cookies set via HTTP response headers are handled directly by the browser and are not visible to JavaScript.

• Scripts and cookies loaded inside cross-origin iframes run in a separate browsing context that the parent-page Osano script cannot inspect.