For sites: Build a script that only adds the analytics/GTM tag/whatever to the page in the callback after user has consented to data sharing.

Transitive dependencies, hm… auditing carefully and being selective about what to add might be my best take.

Apps is a whole different story.