A consent-management script is loaded synchronously in the document head from a vendor domain because no non-essential tag may run before consent. The vendor's edge degrades to a p99 of 8 seconds rather than returning errors. Walk through what happens second by second what the user sees and what stops it.

Second by second

0.0-0.3 s the HTML arrives and the parser reaches the script tag. 0.3 s onward the parser stops. A synchronous external script blocks parsing of everything after it, so no body content is constructed and nothing paints. The preload scanner keeps fetching stylesheets and images, so the network looks busy and the screen is white.

1-3 s users do what users do: they reload. Each reload re-requests the same slow vendor and re-requests your HTML, so your own origin traffic rises during an outage you do not own.

8 s the script arrives, the parser resumes, first paint and largest contentful paint both land at roughly 8 seconds because they could not happen earlier, and the consent banner now covers the content the user waited for.

Everyone who left before 8 seconds sent no beacon. Your field performance dashboard improves while the experience collapses, because the slowest sessions removed themselves from the sample. The honest signal is server-side: HTML requests served versus beacons received.

Where it amplifies

The vendor is a single point of failure for every page, not for a feature. Any tag the consent gate releases — analytics, A/B testing, chat — is also waiting, so one slow dependency silences all measurement at the moment you need it. A content security policy does not help here at all: it governs what may load, not how long you will wait.

What stops it

• Serve the gate from your own origin. Self-hosting the script moves it into your availability and your cache. This is the single change that removes the failure class rather than shortening it.
• If it must be third party, make the first-party bootstrap authoritative. A small inline script sets the deny-all default, renders the page, and upgrades the state when the vendor answers. Give it an explicit deadline — roughly 1.5 s is a defensible choice — after which you proceed as denied. Denial is the conservative direction under consent law, so the timeout is legally safe and commercially unpopular, which is the argument you will actually have.
• Never let a third party hold the parser. defer or async plus a server-rendered page that paints without the script. Note that async alone does not fix a gate: if your own tags await it, the dependency moves from the parser into JavaScript and the banner still arrives at 8 seconds.
• Budget third parties by count bytes and main-thread time with a named owner, reviewed when a tag is added rather than when a quarter ends.

What would have to be true for it to self-heal

The response must be cacheable, so an early visitor's slow fetch warms a shared cache, and your default must be the safe one. Neither is true by accident: vendor consent scripts are commonly served with a short no-store policy precisely so changes propagate.

What the fix costs and when to take it

Self-hosting moves the vendor's release cadence onto your build. Consent-string logic changes when the law or the industry framework changes, and a pinned stale copy turns a performance problem into a compliance one, so the price is a scheduled job that re-pulls and re-pins the bundle plus a test asserting the deny-all default still renders. Choose the self-hosted gate whenever the page is public and a white screen costs revenue; the choice flips when legal requires the vendor's hosted build for certification, and then the first-party bootstrap with a hard 1.5 s deadline is the fallback rather than the ideal. GDPR has applied since May 2018 and synchronous consent tags have been the standard integration since, so this is a decade-old failure class, not a novel one.

When this is the wrong answer

An internal tool behind a corporate network with no consent obligation can load whatever it likes in the head; the blast radius is a known population that will tell you. The engineering above is for pages where an anonymous visitor is also a potential customer.