Most importantly, it should not "disable" them; they should never be enabled (or even loaded) in the first place, and only explicit, opt-in consent should load

Most importantly, it should not "disable" them; they should never be enabled (or even loaded) in the first place, and only explicit, opt-in consent should load them. The vast majority of "consent management platforms" fail at this even if they otherwise appear to be compliant (no dark patterns, etc). The CMP should essentially be the one managing the tracking libraries after correct consent has been collected, yet most websites still embed tracking libraries directly or using something like Google Tag Manager (which itself is a tracker and would require explicit consent).