Freshpaint routes healthcare marketing data through a HIPAA-compliant proxy. Lokker validates and enforces privacy across your full script estate, including the CMP configuration that must correctly gate Freshpaint itself. Most healthcare privacy teams need both.
Freshpaint is a trademark of Freshpaint, Inc. Lokker is not affiliated with or endorsed by Freshpaint, Inc.
Quick summary
Freshpaint
Proxies and de-identifies healthcare marketing data so HIPAA-covered organizations can run advertising programs. Covers only the vendors it explicitly routes.
Lokker
Monitors, validates, and enforces privacy across every third-party script on every page, including the CMP that gates Freshpaint and the scripts it does not proxy.
Together
Freshpaint handles the HIPAA marketing layer. Lokker validates it is correctly gated and governs everything outside Freshpaint's scope.
What Freshpaint does well
The challenge of running digital marketing in healthcare is genuinely hard. Freshpaint addresses it directly for the vendors within its scope.
For a broader comparison of privacy software across healthcare and enterprise contexts, see The 8 Best Data Privacy Software for 2024 on the Lokker blog.
Freshpaint proxies outbound marketing events through its servers, strips electronic protected health information (ePHI) from payloads, and routes compliant event data to advertising and analytics vendors. This enables healthcare organizations to run marketing programs that would otherwise violate HIPAA.
All data sharing in Freshpaint is blocked by default. Marketing teams selectively enable only the vendors they need and only the data fields those vendors require, reducing the surface area of ePHI exposure across the marketing stack.
Freshpaint replaces patient-level identifiers with anonymous IDs, enabling conversion tracking and remarketing without linking events back to identifiable health data. This makes HIPAA-compliant Google Ads and Meta campaigns practical for health systems.
Where Freshpaint stops
Freshpaint addresses the HIPAA marketing layer for the vendors it proxies. The compliance obligations below fall outside its coverage and are what Lokker is built to address.
Freshpaint is purpose-built for healthcare organizations handling ePHI. Organizations outside healthcare, or healthcare teams managing non-patient-facing properties, have no coverage from Freshpaint for GDPR, CCPA, CPRA, VPPA, or state privacy law obligations.
Freshpaint proxies only the vendors it is explicitly configured to handle. Every other third-party script on the page, including session replay tools, analytics platforms, tag managers, and ad pixels it does not proxy, operates without any Freshpaint oversight.
Freshpaint does not continuously scan web properties for third-party tracker changes, consent-state failures, new script additions from tag managers, or GPC signal compliance. There is no portfolio-level risk scoring or alert system.
HIPAA compliance does not satisfy GDPR Article 6 lawful basis requirements, CCPA opt-out of sale and sharing, CPRA sensitive data obligations, or state biometric and health data laws. The consent infrastructure governing Freshpaint and the rest of the stack must still meet these obligations independently.
Side by side
The two platforms operate at different layers of the privacy stack and address different regulatory obligations.
| Capability | Freshpaint | Lokker |
|---|---|---|
| Primary focus | HIPAA-compliant healthcare marketing data routing | Third-party privacy risk intelligence and enforcement across the full web estate |
| Scope of coverage | Vendors explicitly proxied through Freshpaint | Every script, pixel, tracker, and cookie on every page |
| ePHI de-identification | Yes, for proxied healthcare ad and analytics vendors | Not applicable (Lokker monitors and governs, does not proxy data) |
| CMP consent-state validation | Not provided | Yes, automated browser flows in pre-consent, reject, and GPC states |
| Real-time risk monitoring | Not provided | Yes, continuous scanning with reason codes and severity scoring |
| Network-layer enforcement | Proxy-based routing for configured vendors | Guardian blocks unauthorized outbound requests at the browser network layer |
| HIPAA-focused workflow | Yes, core product purpose | Yes, healthcare industry detection and HIPAA-mapped reason codes in Privacy Edge |
| GPC signal enforcement | Not handled by Freshpaint | Yes, validated and enforced across all scripts |
| Portfolio-wide scanning | Not provided | Yes, hundreds or thousands of sites with per-site risk scores |
| Evidence-grade reports | Not provided | Yes, risk and remediation PDFs, payload explorer, GPC compliance reports |
| Works alongside existing CMPs Both | Yes, integrates with OneTrust, Osano, Cookiebot, and others | Yes, validates and monitors CMP behavior independently |
| Deployment effort | One proxy script; vendor-by-vendor configuration | One Guardian snippet; Privacy Edge requires no site-side code changes |
The most searched question
The short answer: no, with narrow exceptions your legal team must evaluate. Here is why.
"Strictly necessary" and "essential" cookie categories in IAB TCF v2.2, OneTrust, Osano, and Cookiebot are reserved for processing that is technically required to deliver the service the visitor explicitly requested. Session management, authentication, and shopping cart persistence are canonical examples. A HIPAA-compliant marketing data proxy that routes advertising and analytics events is not strictly necessary under this definition, regardless of how important it is to your marketing program.
Mis-categorizing Freshpaint as "essential" causes it to load before consent, fire in reject states, and operate without a lawful basis under GDPR Article 6. Under CCPA and CPRA, it also means data is shared with advertising platforms without honoring opt-out of sale and sharing signals, including GPC.
The correct category depends on how Freshpaint is used in your specific deployment. If it routes data exclusively to analytics vendors, it likely belongs in the analytics category. If it enables advertising and remarketing, it belongs in the advertising or targeting category. In either case, it must be gated behind consent or opt-out signals, not pre-loaded.
Guidance references: ICO (UK) cookie guidance, CNIL recommendations on consent banners, IAB TCF v2.2 purpose definitions, OneTrust consent category documentation, HHS OCR guidance on tracking technologies on healthcare websites (2022, updated 2024).
OneTrust
Freshpaint should be assigned to a performance, functional, or targeting consent group. Enabling it in the "Strictly Necessary" category loads it without consent and bypasses your OneTrust reject state logic.
Osano
Osano's consent categories map to IAB TCF purposes. Freshpaint's function of routing marketing data does not satisfy IAB TCF Purpose 1's strictly necessary threshold. Place it under analytics or advertising consent and validate that it gates correctly.
Cookiebot
Cookiebot classifies cookies and scripts into Necessary, Preferences, Statistics, and Marketing. Freshpaint belongs in Statistics or Marketing depending on its downstream vendor configuration. Classifying it as Necessary exposes your organization to regulatory risk.
Validate your Freshpaint categorization
Lokker Consent Validator runs automated browser sessions in pre-consent, reject, and GPC states and tells you exactly whether Freshpaint fires when it should not.
See Consent ValidatorHow it works together
Each tool handles the layer it was built for.
Freshpaint intercepts outbound marketing events, strips ePHI, and routes anonymous event data to configured ad and analytics vendors, fulfilling the HIPAA layer for those specific integrations.
Privacy Edge continuously monitors every third-party request across your web estate. Consent Validator runs automated reject and GPC flows to confirm Freshpaint and all other vendors are correctly gated behind your CMP.
For every script Freshpaint does not proxy, Guardian intercepts network requests at the browser layer, blocking unauthorized data flows in real time based on your trust rules in Privacy Edge.
Healthcare context
Healthcare organizations face overlapping obligations from HIPAA, state privacy laws, and now OCR guidance on tracking technologies. Lokker is built for the complexity of managing third-party risk across patient-facing and public-facing properties.
Scan patient-facing and public-facing web properties for third-party trackers, consent failures, and ePHI exposure risks. Aligned with OCR guidance on tracking technologies.
Explore healthcare solutionCMP categorization, HIPAA coverage boundaries, GPC handling, and the privacy questions to answer before deploying Freshpaint on your web estate.
See Freshpaint topicsCompare Clarity, Hotjar, FullStory, LogRocket, Mouseflow, Glassbox, PostHog, and Smartlook on privacy defaults, HIPAA BAA availability, GPC support, and consent gating.
Compare session replay toolsCommon questions
The most common questions from privacy teams, legal counsel, and healthcare marketing leaders evaluating both tools.
Next step
Lokker confirms that Freshpaint is correctly gated in your CMP, surfaces risks across your full third-party script estate, and enforces blocking for unauthorized data flows in real time.