For vendors with no [bridge](/integrations/bridges/) — Meta Pixel, TikTok,
LinkedIn, Hotjar, embedded iframes — mark the `<script>` with a placeholder type
and a category. The CMP won't execute it until that category is granted.

## The markup

```html
<script
  type="text/plain"
  data-cookieconsent="statistics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"
></script>
```

- `type="text/plain"` makes the browser treat it as inert data, not code.
- `data-cookieconsent="<category>"` names the gating category. The first-party
  alias `data-lightning-consent` works too.
- Categories: `necessary`, `preferences`, `statistics`, `marketing`.

It's **Cookiebot-compatible**, so if you're migrating from Cookiebot your
existing `data-cookieconsent` markup keeps working.

## Common vendors

The same pattern gates Meta Pixel, TikTok, LinkedIn Insight, X/Pinterest/Snapchat
pixels (all `marketing`), Hotjar / Microsoft Clarity (`statistics`), and iframe
embeds like YouTube or Google Maps.

:::caution[Don't block Google tags]
A hard-blocked Google tag forfeits its cookieless Consent Mode pings and the
conversion modelling that recovers denied data. Use the
[Google bridge](/integrations/bridges/#google-gtag--gtm) instead.
:::

:::note[More detail coming]
Per-vendor recipes (including `<iframe>` embeds) are being migrated from
`docs/INSTALL.md` § _“Gating individual trackers.”_
:::