A page can carry a consent banner and still load its tags regardless. This fetches the delivered HTML and separates three things: which measurement and advertising services are wired in, which consent tool is present, and whether that tool actually holds anything back. The cookies listed at the end come from the first response - before anyone clicked anything.
The page is fetched once from this server, with a plain GET and no cookies. Requests to private networks, to loopback and to link-local addresses are refused, including through redirects. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate - ten queries per address per hour.