It actually blocks

<div class="demo">
  <div class="demo-kv">
    <div><span class="demo-hint">analytics tag</span><br><b id="a">blocked</b></div>
    <div><span class="demo-hint">marketing tag</span><br><b id="m">blocked</b></div>
    <div><span class="demo-hint">needs both</span><br><b id="b">blocked</b></div>
  </div>

  <!-- Inert markup: never fetched, never run. -->
  <script type="text/plain" data-cc="analytics">document.getElementById('a').textContent = 'ran';</script>
  <script type="text/plain" data-cc="marketing">document.getElementById('m').textContent = 'ran';</script>
  <script type="text/plain" data-cc="analytics marketing">document.getElementById('b').textContent = 'ran';</script>

  <p class="demo-hint">An embed, held back until marketing is allowed:</p>
  <iframe id="embed" data-cc="marketing" data-cc-src="https://www.openstreetmap.org/export/embed.html?bbox=55.26%2C25.18%2C55.30%2C25.21" title="A map" class="demo-frame"></iframe>

  <div class="demo-row">
    <button class="demo-btn" id="again">Ask me again</button>
    <a href="#" data-cc-open class="demo-link">Cookie settings</a>
  </div>
  <p class="demo-out" id="out">No decision yet</p>
</div>

import { createCookieConsent } from 'https://www.devix.pk/cdn/oss/cookie-consent@1.0.0/index.js';

const out = document.getElementById('out');

const consent = createCookieConsent({
  storage: { name: 'demo_consent', days: 1 },
  policyUrl: '#',
  categories: [
    { id: 'necessary', label: 'Strictly necessary', description: 'Keeps this demo working.', required: true },
    { id: 'analytics', label: 'Analytics', description: 'Counts which demos are opened.', autoClear: [{ name: '_ga_.*', pattern: true }] },
    { id: 'marketing', label: 'Marketing', description: 'The map embed, and anything that profiles you.' },
  ],
});

const report = () => {
  const record = consent.record();
  out.textContent = record ? `${record.via} · allowed: ${record.categories.join(', ')} · refused: ${record.refused.join(', ') || 'nothing'}` : 'No decision yet';
  for (const [id, key] of [['a', 'analytics'], ['m', 'marketing']]) {
    if (!consent.accepted(key)) document.getElementById(id).textContent = 'blocked';
  }
};

consent.on('firstconsent', report);
consent.on('change', report);
report();

document.getElementById('again').addEventListener('click', () => {
  consent.withdraw();
  location.reload();
});

@import url('https://www.devix.pk/cdn/oss/cookie-consent@1.0.0/cookie-consent.min.css');

/* The notice belongs to this frame, so it sits inside the preview. */
.dxcc-banner { position: absolute; }
.demo-frame { width: 100%; height: 160px; border: 1px solid var(--demo-line); border-radius: 8px; }
[data-cc-placeholder] { min-height: 160px; color: var(--demo-muted); font-size: 12px; }
[data-cc-placeholder]::after { content: 'Allow marketing cookies to see the map'; }
.demo-link { color: var(--demo-accent); font-size: 12px; }