Use Cases

Solutions

See how Lokker supports litigation and discovery, M&A due diligence, board and risk reporting, and portfolio monitoring, with products that link into your workflow.

Behind the page

What visitors see is only half the story.

Drag the slider to compare a typical marketing surface to the requests, pixels, and policy gaps that actually run in the browser: the parts that are easy to miss in a visual review alone.

Exposure summary

Page /appointments

Same URL as the patient portal: findings map to reason codes, evidence, and remediation your teams can execute.

Risk score

612 / 1000

Critical

High

CriticalPIXEL_PRE_CONSENT

Marketing pixel fired before consent was recorded

Outbound requests to a major ad pixel included purchase-style parameters while the CMP still showed “preferences not saved.”

Remediation

Gate the pixel behind your CMP’s “analytics/advertising” bucket and verify with a fresh session.
Remove duplicate container loads so one tag cannot bypass the other.

HighMETA_PIXEL_HEALTH_CONTEXT

Meta Pixel and session replay on pages with scheduling and contact fields

A Meta Pixel and a third-party session replay tool are both present where visitors can enter appointment or contact details. On a healthcare site, that pairing creates outsized HIPAA-related privacy risk, even before you argue whether a given field is “PHI” on its own.

Remediation

Remove or strictly gate the pixel until consent and purpose align with your health-data policies.
Mask or disable session replay on flows that collect health-adjacent or identifiable information.

MediumTAG_SPRAWL_PRE_CLICK

Tag manager injected six vendors before first deliberate click

Several hosts were not reflected in your public cookie disclosure at the time of scan.

Remediation

Tighten container triggers to “consent granted” + meaningful interaction.
Publish an updated disclosure that matches measured third-party reality.

PolicyGPC_SIGNAL_IGNORED

GPC honored in UI copy but ignored on a consent API

The browser sent GPC=1 on the consent verification POST; the response still treated the session as marketable.

Remediation

Thread opt-out signals through backend consent verification, not only the banner script.
Add an automated check that GPC alters the same endpoints your CMP claims to control.

Request trace 14 hosts · 6 pre-interaction

GET /appointments · 200 · document

GET connect.facebook.net/…/fbevents.js · 200

POST pixel.vendor/collect · body: event=Lead…

https://portal.wellhartclinic.org/appointments

Wellhart Clinic

Primary & specialty care

Privacy choices. We use cookies and similar technologies. Manage preferences or accept to continue.

Clinical team collaborating: illustrative photo for a fictional patient portal

Board-certified providers · Virtual & in-person

Photo by National Cancer Institute on Unsplash

Same-day & scheduled visits

Care that fits your schedule

Book appointments, message your care team, and see test results: the experience patients expect from a modern health system.

Book an appointment Find a location

Illustrative example, not a real clinic.

Popular on this site

Primary care

Video visit

Test results

Secure sign-in · Messages in transit encrypted

Drag the grip to move the split (clicking the page does not jump it). Scroll the panel on the right independently. Left: patient-facing page · Right: findings and request trace.

Solutions

What visitors see is only half the story.

Page /appointments

Marketing pixel fired before consent was recorded

Meta Pixel and session replay on pages with scheduling and contact fields

Tag manager injected six vendors before first deliberate click

GPC honored in UI copy but ignored on a consent API

Care that fits your schedule

Litigation & discovery

M&A due diligence

Board & risk reporting

Portfolio monitoring

Healthcare

Consent Audit & Validation

Third-Party Script Governance