[martin_a]

> What can I do as a developer to offer that choice to the user, before it loads?

Implement a (sane) version of a cookie banner which sets a cookie containing the information that the user is fine with loading external libraries or not. That cookie itself is classified as a technical cookie if only used for that reason and will not require "permission" from the user. That's how this would be implemented in a GDPR-compliant way.

If the cookie is set, you can load the respective external scripts and tools. If not, you don't.

> What can I do about the transitive dependencies that my dependencies load?

That's trickier one and probably more into the legal side, as in informing the user that those dependencies exist and how they correlate to each other.

[jampekka]

Or even better if you don't do shady shit that people don't want (e.g. Google Analytics), you don't need any banners at all.