A very common issue
The most frequent mistake is not a complex bug. It is simply a loading order issue.
If tarteaucitron loads after the services it should control, it cannot block anything.
A very concrete example
If Google Analytics is present in the <head> before the tarteaucitron tag, it has already run. At that point, consent has no effect.
This situation often appears during integration audits.
Be careful with defer and async
Adding defer or async to the main script may seem harmless. In reality, it can delay execution and break the blocking logic.
A CMP must load first. Otherwise, it is always too late.
A fundamental rule
This point is detailed in how service loading works, but it deserves repeating.
Compliance often starts with a simple tag order in the HTML.