Predictive automation using behavioural segments

Automation that waits for the purchase arrives late

Most marketing automation is built on the past tense. Someone signed up, so they get a welcome email. Someone left a basket, so they get a reminder. Someone bought, so they get a thank you and a review request. All of it useful, and all of it waiting for the customer to do something first.

The people it never reaches are the ones still deciding. They have looked at three bikes, read the size guide twice, come back on Thursday evening, and not yet put anything in the basket. To a reactive setup they do not exist. Predictive automation is the idea that what people do before they buy tells you something about whether they will, and that you can act on it while they are still making up their minds.

None of that needs a crystal ball. It needs a segment written as a rule, a probability, a test that shows the probability is honest, and a decision about who a message actually helps. Then the ready made versions, and what EU law, as it applies in Ireland, says about profiling.

Throughout I use one invented business. Curlew Cycles is an online bike shop in Galway, run by Aoife, selling bikes, parts and kit at curlewcycles.example. In a typical four weeks it has 40,000 visitors and 600 orders, so 1.5% of visitors buy. Nobody real, and every number is made up so I can show every step.

Worked example: the buyers nobody talks to

Aoife's automation sends a welcome email, a basket reminder and a review request after delivery. Last month 2,400 visitors looked at three or more bikes without adding anything to the basket. Not one of them received a message, because none did any of the three things the automation listens for. 168 of them bought within a fortnight anyway. The rest drifted off, some of them to another shop. That gap is what this article is about.

A behavioural segment is a rule about what people did

A segment is a group of people you will treat differently. A behavioural segment draws the line on what people did, not on who they are: pages viewed, visits made, baskets started, orders placed, and how recently. I prefer behaviour to demographics for this job because it is closer to the decision. A 45 year old in Salthill tells you very little about whether they are buying a bike this week. Three visits to the same gravel bike tells you a lot. I make the wider case in segmentation strategy before algorithms.

The research backs the instinct. Fader, Hardie and Lee showed that a model needing nothing more than recency, frequency and monetary value can project the future value of each customer.¹ In my experience, what people did, how often and how lately, carries most of the signal.

In practice a behavioural segment is a query. It runs on a schedule in the warehouse, rewrites a table every morning, and that table is what the email tool and the ad platforms read. I set out how that loop works, and how permission is checked inside every query, in data warehousing for marketing automation, so here I only show the segment itself.

Worked example: Curlew's comparers

Aoife's data lives in BigQuery, with one row per website session: the visitor, the date, how many product pages they viewed, and whether they added anything to the basket. Her first segment is "comparers": visitors who viewed three or more product pages over the last seven days and added nothing to the basket.

SELECT visitor_id,
       SUM(product_views) AS product_views_7d,
       COUNT(*)           AS sessions_7d
FROM analytics.sessions
WHERE session_date >= DATE_SUB(CURRENT_DATE('Europe/Dublin'), INTERVAL 7 DAY)
GROUP BY visitor_id
HAVING SUM(product_views) >= 3
   AND COUNTIF(added_to_basket) = 0;

The WHERE line keeps the last seven days of sessions. The GROUP BY brings each visitor down to one row. The HAVING lines keep visitors whose seven days add up to three or more product views and not a single basket. On Monday morning it returns 2,400 visitors. It is not clever, and it does not need to be. It is a precise description of a behaviour, written once and checked every day.

The first prediction is a simple count

Before any model, the most useful number is this: of the people who fall into the segment, what share go on to buy? That is a conditional probability, the chance of one thing given that another has happened.

$$P(\text{buy} \mid \text{segment}) = \frac{P(\text{buy} \cap \text{segment})}{P(\text{segment})}$$

Here $P(\text{buy} \mid \text{segment})$ is the chance that someone buys given that they are in the segment, $P(\text{buy} \cap \text{segment})$ is the share of all visitors who are in the segment and also buy, and $P(\text{segment})$ is the share of all visitors who are in the segment. The vertical bar reads "given". Conditional probability is explained from scratch in Foundations: probability.

The number only means something next to the base rate, the share of everyone who buys. A segment where 3% buy sounds poor until you learn that only 0.5% of everyone else does.

Worked example: are comparers worth talking to?

Over four weeks Curlew had 40,000 visitors. 2,400 were comparers, and 168 of those bought within 14 days. So:

$$P(\text{buy} \mid \text{comparer}) = \frac{168 / 40{,}000}{2{,}400 / 40{,}000} = \frac{0.0042}{0.06} = 0.07$$

Here $168 / 40{,}000 = 0.0042$ is the share of all visitors who were comparers and bought, and $2{,}400 / 40{,}000 = 0.06$ is the share who were comparers at all. The 40,000 cancels, so it is simply 168 out of 2,400, which is 7%.

The other 37,600 visitors produced the remaining 432 orders, which is 1.15%. The base rate for everyone is 600 out of 40,000, so 1.5%. Comparers buy at more than four times the rate of an average visitor. That one count already justifies a message. It also sets the bar every later model has to beat. Foundations: indexing and base rates shows why a rate means nothing without its base.

Points are not probabilities

The old version of this article scored visitors with points: five for three product views, two for scrolling past 75% of a page, three for arriving from anywhere other than Google, and a message at seven. I have built scores like that myself. They feel scientific, and they are not.

A points score has no unit. You cannot multiply eight points by a margin to decide whether a voucher pays. The weights were also guesses, never checked against who actually bought.

The standard fix is logistic regression, a model built for yes or no outcomes such as "bought within 14 days". It weighs each signal from your own history and returns a genuine probability between 0 and 1.²

$$p = \frac{1}{1 + e^{-(\beta_0 + \beta_1 x_1 + \beta_2 x_2 + \beta_3 x_3)}}$$

Here $p$ is the probability that the visitor buys, $e$ is the constant 2.718 that sits behind natural logarithms, $\beta_0$ is the intercept (the starting point for someone with no signals at all), $x_1$, $x_2$ and $x_3$ are the visitor's signals, and $\beta_1$, $\beta_2$ and $\beta_3$ are the weights the model learns for each signal from past visitors. The part in brackets is the log odds. Each extra unit of a signal $x_j$ multiplies the odds of buying by $e^{\beta_j}$.² Logistic regression is introduced in Foundations: regression, and logarithms and $e$ in Foundations: logarithms.

You do not fit this by hand. In BigQuery, a CREATE MODEL statement with the model type LOGISTIC_REG fits a logistic regression on a table of past visitors and whether they bought.³ The judgement is in choosing the signals and testing the result, not in the arithmetic.

Worked example: two visitors, two probabilities

Aoife fits a model on September's visitors, with three signals: $x_1$ the number of product pages viewed in seven days, $x_2$ equal to 1 if the visitor came back on a second day and 0 if not, and $x_3$ equal to 1 if they opened the size guide. The model returns $\beta_0 = -5.0$, $\beta_1 = 0.35$, $\beta_2 = 0.9$ and $\beta_3 = 1.2$.

Visitor A viewed four bikes, came back on Thursday and opened the size guide:

$$z_A = -5.0 + 0.35 \times 4 + 0.9 \times 1 + 1.2 \times 1 = -1.5, \qquad p_A = \frac{1}{1 + e^{1.5}} = \frac{1}{1 + 4.48} = 0.182$$

Here $z_A$ is visitor A's log odds, the bracket of the formula, $4$, $1$ and $1$ are the values of $x_1$, $x_2$ and $x_3$, $e^{1.5} = 4.48$, and $p_A$ is the probability. So visitor A has an 18.2% chance of buying in the next fortnight.

Visitor B viewed one bike once and left:

$$z_B = -5.0 + 0.35 \times 1 = -4.65, \qquad p_B = \frac{1}{1 + e^{4.65}} = \frac{1}{1 + 104.6} = 0.009$$

Here $z_B$ is visitor B's log odds, $1$ is the single product view $x_1$, both other signals are $0$, and $e^{4.65} = 104.6$. That is a 0.9% chance, below the shop's base rate of 1.5%. Now the numbers have a unit. Visitor A is 20 times as likely to buy as visitor B, and a probability can go straight into the money decision further down. Here is the same calculation as Aoife's nightly job runs it:

import math

WEIGHTS = {"intercept": -5.0, "product_views": 0.35,
           "came_back": 0.9, "size_guide": 1.2}

def purchase_probability(visitor):
    log_odds = (WEIGHTS["intercept"]
                + WEIGHTS["product_views"] * visitor["product_views"]
                + WEIGHTS["came_back"] * visitor["came_back"]
                + WEIGHTS["size_guide"] * visitor["size_guide"])
    return 1 / (1 + math.exp(-log_odds))

purchase_probability({"product_views": 4, "came_back": 1, "size_guide": 1})

Test the score on people it has never seen

A model always looks good on the data it learnt from. It has, in effect, seen the answers. What matters is how well it does on people it has never met, which statisticians call the test error, as opposed to the training error.⁴ So I always fit on one period and judge on the next.

The test I use most is a lift table. Rank everyone in the new period by their predicted probability, cut the ranked list into ten equal groups called deciles, and count the buyers in each. A good score piles the buyers into the top deciles.

$$\text{lift}_k = \frac{b_k / n_k}{B / N}$$

Here $\text{lift}_k$ is the lift of decile $k$, $b_k$ is the number of buyers in that decile, $n_k$ is the number of visitors in it, $B$ is the total number of buyers, and $N$ is the total number of visitors. A lift of 1 means the decile buys at the average rate, and a lift of 4 means four times the average. It is a ratio of two rates, explained in Foundations: ratios and rates, set against a base rate as in Foundations: indexing and base rates. For a longer treatment of decile tables and gains charts, I wrote about logistic regression and lift charts separately.

Worked example: October's lift table

Aoife's model was fitted on September. She scores October's 40,000 visitors with it, ranks them, and cuts them into ten deciles of 4,000. October has 600 buyers, and here is where they fall.

The horizontal axis is the decile, from the 4,000 visitors with the highest predicted probability on the left to the 4,000 with the lowest on the right. The vertical axis is how many of them bought in October. The takeaway: the model was fitted on September and had never seen these people, and it still put 270 of the 600 buyers in the top tenth. The top two deciles hold 390 buyers, which is 65% of all buyers in 20% of the visitors.

The lift of the top decile is:

$$\text{lift}_1 = \frac{270 / 4{,}000}{600 / 40{,}000} = \frac{0.0675}{0.015} = 4.5$$

Here $270 / 4{,}000 = 6.75\%$ is the buying rate in the top decile and $600 / 40{,}000 = 1.5\%$ is the base rate. A lift of 4.5 is a little below the 4.7 that the plain comparer rule managed (7% against 1.5%), though that rule only covers 6% of visitors. That is worth noticing rather than hiding. The model's advantage is not the top group. It is that it ranks everyone, so Aoife can choose how far down the list to go, which the yes or no rule cannot do. If a model cannot beat a simple count on new data, I keep the count.

Target the people the message changes

Here is the mistake that costs the most money, and that the old version of this article made. It is natural to send the offer to the people most likely to buy. But many of them were going to buy anyway. A voucher sent to someone who had already chosen their bike is a discount on a sale you already had.

What matters is not the probability of buying. It is how much the message changes that probability. Eva Ascarza made this point for retention in the Journal of Marketing Research: across field data from two companies, targeting customers by how strongly they respond to the intervention reduced churn more than targeting those at highest risk.⁵ The same logic holds before the first purchase.

The only way to see that change is a holdout: pick the group at random, send the message to some, send nothing to the rest, and compare. The value of a message per person is then:

$$E[\text{profit}] = (p_t - p_c) \times m - p_t \times v$$

Here $E[\text{profit}]$ is the expected extra profit per person messaged, $p_t$ is the buying rate in the group that got the message, $p_c$ is the buying rate in the holdout that did not, $m$ is the margin on an order, and $v$ is the cost of any voucher, which only the buyers redeem. The first part is the margin the message created, and the second is the voucher handed to every buyer, including those who would have bought without it. Expected value is explained in Foundations: expected value.

Worked example: comparison email or voucher?

In November, 1,500 of Aoife's comparers are identifiable subscribers with marketing permission. She splits them at random into three groups of 500. One gets nothing. One gets a plain email comparing the three bikes they looked at, with frame sizes and delivery dates. One gets the same email plus a €25 voucher. An order from a comparer earns Curlew €150 of margin on average.

Within a fortnight, 45 of the holdout buy (9.0%), 54 of the plain email group (10.8%) and 60 of the voucher group (12.0%).

$$E_{\text{plain}} = (0.108 - 0.090) \times 150 - 0 = 2.70, \qquad E_{\text{voucher}} = (0.120 - 0.090) \times 150 - 0.120 \times 25 = 1.50$$

Here $E_{\text{plain}}$ and $E_{\text{voucher}}$ are the extra profit per person in euro, $0.108$ and $0.120$ are the two treated rates $p_t$, $0.090$ is the holdout rate $p_c$, $150$ is the margin $m$ in euro and $25$ is the voucher $v$ in euro. Across 500 people, the plain email is worth €1,350 and the voucher email €750. The voucher sold more bikes and earned less, because it went to all 60 buyers and only 15 of them were extra.

The horizontal axis shows the two messages. The vertical axis is the extra profit in euro each created for 500 people, compared with the holdout that received nothing. The takeaway: the message that sold more is not the message that earned more.

One honest caveat. With 500 people per group, these differences are not yet proof. A two proportion test of the voucher group against the holdout gives a z of about 1.5, short of the 1.96 needed for 95% confidence, and the plain email gives about 0.95. Foundations: hypothesis tests shows the calculation, and Foundations: sample size shows how many people a test like this needs. So Aoife makes the plain email the default, because it costs nothing, and keeps the three way split running every month until the numbers settle. The holdout is not a one off experiment. It is a permanent part of the automation.

Lifecycle groups decide the cadence, not the content

The old version of this article grouped people into fast movers, window shoppers and researchers. It is a good idea and I kept it, with a definition for each that a query can check.

Fast movers buy within a couple of days of their first visit. Researchers come back over weeks before buying. Window shoppers browse product pages again and again and never put anything in the basket. Each needs a different rhythm. A fast mover who has not bought after three days probably will not, so more messages are noise. A researcher on day ten is on schedule and needs information, not a nudge. A window shopper may simply enjoy looking at bikes.

The old window shopper query had a bug worth learning from. It kept only product page rows in WHERE, then checked in HAVING that no basket event appeared. Basket events never sit on product page rows, so the check was always true, and people who had added to the basket counted as window shoppers too. The fix is to count each behaviour across all of a visitor's sessions:

SELECT visitor_id
FROM analytics.sessions
WHERE session_date >= DATE_SUB(CURRENT_DATE('Europe/Dublin'), INTERVAL 90 DAY)
GROUP BY visitor_id
HAVING COUNTIF(product_views > 0) >= 4
   AND COUNTIF(added_to_basket) = 0
   AND COUNTIF(ordered) = 0;

When someone is likely to buy, or to lapse after buying, is a timing question with its own tools, survival analysis. I cover it in survival analysis, churn and customer lifetime value, so I will not repeat it here.

Worked example: three rhythms at Curlew

Aoife looks at the 5,000 first orders of the past year. 1,600 came within two days of the first visit (fast movers, 32%), 2,100 after three or more visits spread over 14 days or more (researchers, 42%), and 1,300 somewhere in between. The window shopper query, run over 90 days, finds 3,800 visitors who fit, 1,100 of them subscribers.

So she sets three cadences. Fast movers get the comparison email on day one and nothing more unless they come back. Researchers get the comparison email when they first become comparers, and a second email a week later with a guide to choosing a frame size, the thing her customer service team is asked most. Window shoppers get only the monthly newsletter. Fewer emails overall, each one timed to where the person actually is.

Ready made predictions need more data than most shops have

You do not always have to build the model. Google Analytics 4 offers predictive metrics: purchase probability (the chance that a user active in the last 28 days buys within the next seven), churn probability (the chance that a user active in the last seven days is not active in the next seven) and predicted revenue over the next 28 days.⁶ From those it suggests ready made audiences, such as likely purchasers in the next seven days and predicted top spenders over the next 28, which can be shared with Google Ads.⁷

The catch is the threshold. In the last 28 days, over a seven day period, at least 1,000 returning users must have triggered the condition (bought, say) and at least 1,000 must not have. The model's quality must also hold up over time, and purchase predictions need the purchase event sent with its value and currency.⁶

Klaviyo's predictions sit on the customer side. Its predicted lifetime value and churn risk need at least 500 customers who have placed an order, at least 180 days of order history with orders in the last 30 days, and some customers with three or more orders.⁸ Those predictions are about existing customers, not about visitors still deciding on their first purchase.

Worked example: is Curlew eligible?

Curlew's 600 orders in four weeks come to about 150 buyers in a typical week. Google needs 1,000 returning users who bought within a single seven day window, so Aoife would need almost seven times her current sales before GA4's purchase probability appears. Her own model, fitted on a month of her own data, works now.

Klaviyo is another story. Curlew has more than 500 customers with an order, well over 180 days of history, orders every day, and a good few riders who come back three or more times for parts. So Aoife can use Klaviyo's churn risk for existing customers today, and her own model for visitors before their first order. Two tools, two different questions, and no bother running both.

Profiling is allowed, within limits you should know

Everything above is profiling in the legal sense. The GDPR defines it as any automated processing of personal data used to evaluate personal aspects of someone, in particular to analyse or predict things such as their personal preferences, interests, behaviour, location or movements.⁹ A purchase probability is exactly that. In Ireland that is the EU regulation itself, enforced by the Data Protection Commission (DPC), and three rules matter for a shop.

First, people can object. Where data is used for direct marketing, a person has the right to object at any time, including to profiling related to that marketing, and once they do the data can no longer be used for it.¹⁰ So an objection has to remove someone from the scoring, not just from the email list.

Second, automated decisions. Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects on them or similarly significantly affects them. There are three exceptions: the decision is needed for a contract, it is authorised by EU or Irish law with suitable safeguards, or it rests on explicit consent. In the contract and consent cases the person must at least be able to obtain human intervention, give their point of view and contest the decision. Decisions based on special category data, such as health, are tighter still.¹¹ That text applies in Ireland as written, and the Court of Justice has read it widely. In its SCHUFA judgment of 7 December 2023 it held that where a probability value plays a determining role in what someone else then does with a person (in that case a bank deciding on credit), establishing the score counts as the decision itself.¹² A score is not safe simply because another system acts on it.

A comparison email is not a significant decision. The Article 29 Working Party's guidelines on automated decision making, which the European Data Protection Board (EDPB) endorsed on the day the GDPR applied,¹³ say that in many typical cases targeted advertising based on profiling will not have a similarly significant effect. It may, depending on how intrusive the profiling is (tracking people across websites and devices, for example), what people expect, how the advert is delivered, and whether it uses knowledge of their vulnerabilities. The same guidelines say differential pricing based on personal data could have a significant effect, for example where prohibitively high prices bar someone from goods or services.¹⁴

Third, the signals themselves. Behaviour on a website is usually collected with cookies or similar storage, and in Ireland that falls under regulation 5 of the ePrivacy Regulations 2011. Storing or reading information on a visitor's device needs their consent and clear information about the purposes. There are only two exceptions, for transmitting a communication and for what is strictly necessary to provide a service the visitor explicitly asked for, and there is no exception for statistics.¹⁵ The DPC says plainly that analytics cookies need consent and that cookies related to advertising must be consented to.¹⁶ Scoring people for marketing is neither transmission nor strictly necessary, so it rests on consent. How I set up consent for tracking is in event tracking and consent mode. I am an engineer, not a solicitor, so for anything that goes beyond these basics I would ask one.

Worked example: the idea Aoife dropped

Halfway through, Aoife has an idea. High scorers will probably buy anyway, so why not hide the free delivery offer from them? It would save a few euro an order.

I talked her out of it. A price that differs by profile is the case the guidelines single out as able to have a significant effect, and after SCHUFA the score behind it would count as the decision. Free delivery is a small sum, but I would not want to argue where the line sits. And the highest scorers are her most engaged customers, the last people she wants to find out they paid more for delivery than a stranger. So the scores decide who gets help and when, never who pays what.

Putting it together: one loop that runs every night

Here is the whole thing as Aoife now runs it, from the raw sessions to the message and back.

Read it from the top, each box waiting for the one above. The two decision boxes are the business rule (likely enough to be worth a message?) and the permission rule (may I contact them at all?). The takeaway: the model is one box out of ten. Most of the value is in the boxes around it.

Worked example: one Tuesday night

On Tuesday night the warehouse holds four weeks of sessions from 39,637 consenting visitors. 37 of them objected last week and are removed first. The model scores the remaining 39,600, and 1,900 are above Aoife's line of a 10% purchase probability. 640 of those are subscribers with marketing permission. A random 20%, 128 people, go into the holdout and get nothing. The other 512 get the comparison email, timed by their lifecycle group. A month later, the difference between the two groups is the answer to the only question that matters: did the email sell bikes that would not otherwise have sold?

Predict, then prove it

Write the behaviour down as a rule. Count how often it leads to a purchase. Turn the signals into a probability and test it on people the model has never seen. Send the message to the people it helps, and keep a holdout so you know whether it did.

In the shops I have worked on, the model is rarely what goes wrong. What goes wrong is nobody checking the score on fresh data, vouchers going to people who were buying anyway, or an objection that only removes someone from one list.

Footnotes

1. Peter S. Fader, Bruce G. S. Hardie and Ka Lok Lee, RFM and CLV: Using iso value curves for customer base analysis, Journal of Marketing Research 42(4), 2005 (authors' final working paper), https://www.brucehardie.com/papers/rfm_clv_2005-02-16.pdf

2. Gareth James, Daniela Witten, Trevor Hastie and Robert Tibshirani, An Introduction to Statistical Learning, section 4.3 Logistic Regression, Springer, 2013, https://www.statlearning.com/s/ISLR-Seventh-Printing.pdf

3. Google Cloud, The CREATE MODEL statement for generalized linear models, BigQuery documentation, 2026, https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-create-glm

4. Gareth James, Daniela Witten, Trevor Hastie and Robert Tibshirani, An Introduction to Statistical Learning, section 2.2.3 The Classification Setting, Springer, 2013, https://www.statlearning.com/s/ISLR-Seventh-Printing.pdf

5. Eva Ascarza, Retention futility: targeting high risk customers might be ineffective, Journal of Marketing Research 55(1), 2018, pp. 80 to 98, summarised by the American Marketing Association, https://www.ama.org/2019/04/24/escarzas-retention-futility-targeting-high-risk-customers-might-be-ineffective-wins-2018-award/

6. Google, Predictive metrics, Analytics Help, 2026, https://support.google.com/analytics/answer/9846734

7. Google, Predictive audiences, Analytics Help, 2026, https://support.google.com/analytics/answer/9805833

8. Klaviyo, Understanding Klaviyo's predictive analytics, Klaviyo Help Center, 2026, https://help.klaviyo.com/hc/en-us/articles/360020919731

9. Regulation (EU) 2016/679, General Data Protection Regulation, Article 4(4), definition of profiling, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

10. Regulation (EU) 2016/679, General Data Protection Regulation, Article 21(2) and (3), right to object to direct marketing, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

11. Regulation (EU) 2016/679, General Data Protection Regulation, Article 22, automated individual decision making, including profiling, EUR-Lex, 2016, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

12. Court of Justice of the European Union, Judgment of 7 December 2023, OQ v Land Hessen (SCHUFA), Case C 634/21, ECLI:EU:C:2023:957, paragraph 50 and operative part, EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634

13. European Data Protection Board, Endorsement 1/2018, EDPB, 25 May 2018, https://www.edpb.europa.eu/sites/default/files/files/news/endorsement_of_wp29_documents_en_0.pdf

14. Article 29 Data Protection Working Party, Guidelines on Automated individual decision making and Profiling for the purposes of Regulation 2016/679, WP251rev.01, revised and adopted 6 February 2018, European Commission, https://ec.europa.eu/newsroom/article29/items/612053

15. Government of Ireland, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, S.I. No. 336 of 2011, regulation 5, Irish Statute Book, 2011, https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print

16. Data Protection Commission, Guidance note on cookies and other tracking technologies, DPC, April 2020, https://www.dataprotection.ie/sites/default/files/uploads/2020-04/Guidance%20note%20on%20cookies%20and%20other%20tracking%20technologies.pdf