Say “personalization” in a room with your DPO in it, and watch the conversation slow down. That reflex makes sense. A lot of personalization tooling works by building persistent cross-session profiles that follow individuals across properties, or by feeding behavioral data to third parties for ad targeting. Predictive preloading, as we build it, does neither.

What gets processed

Foresight’s model trains on aggregate navigation patterns: the statistical relationship between “a session that looks like this” and “the page that type of session tends to visit next.” It keeps no profile of an individual across visits. Each prediction covers one session’s likely next step, based on patterns from historical sessions in aggregate. The visitor’s identity and last month’s activity play no part.

The distinction has legal weight. Persistent individual profiling and third-party data sharing tend to trigger the heaviest consent requirements. Aggregate pattern-based prediction, confined to preloading content within your own site, sits closer to standard analytics than to ad-tech personalization.

Your consent setup for Foresight follows your consent setup for GA4, because Foresight trains on your GA4-to-BigQuery export. If your GA4 implementation has the right configuration and consent for your jurisdiction, Foresight puts data you collect anyway to one more internal use (predicting navigation) and adds no new category of processing.

We’re not a law firm. Your DPO or counsel should decide whether this complies for your site, jurisdiction, and audience. We can tell you which data the model touches and where it’s processed, and we hand that over for your own compliance review so you don’t have to take our word for it.

What we won’t do

We build no individual-level profiles and expose none. No data leaves your GA4/BigQuery/GTM stack for a third-party ad platform. Foresight adds no tracking beyond what your analytics already collects; it reuses that data and opens no new collection surface. If your GA4 setup respects consent mode and regional requirements, Foresight’s data use follows the same rules.

Why privacy-by-design keeps this light

Privacy-by-design is a legal requirement, and it also keeps the approach light. A system built on persistent cross-session profiles needs more infrastructure and storage, and carries more consent risk. Working from aggregate session patterns in data you already collect makes the system simpler to build, to explain to a DPO, and to shut off.

If your team wants to know whether your DPO can sign off on this, an audit walks through what Foresight touches, so you get an answer instead of a reassurance.