A journalist who requested his personal data from McDonald's received a 515-page file filled with behavioral predictions, transaction logs, and algorithmic profiles, a window into how the fast-food giant tracks and forecasts the habits of its loyalty-program members.
Reece Rogers, a reporter at Wired magazine, submitted a data request through McDonald's Privacy Rights Center and got back something closer to a surveillance briefing than a customer receipt. The file predicted Rogers would visit McDonald's 2.16 times over the next six weeks, spend an average of $13.49 per order, and drop a total of $29.15 during that stretch. It ranked a Large Diet Coke as his most relevant product, followed by a Spicy Snack Wrap and The Grinch McShaker Fry Large. McDonald's algorithms had slotted him into behavioral categories like "Food-Led Afternoon Snack" and "On the Go Lunch in a Rush."
Most striking: the company assigned Rogers a "Customer Attrition Likelihood" of zero, meaning its models calculated he would never leave. The dossier also contained a detailed history of every transaction, every promotional offer McDonald's had sent him, every loyalty point he had accumulated, and every instance he scanned a code during the chain's Monopoly sweepstakes, including the prizes he received.
Rogers requested deletion of his data and said he would stop patronizing the restaurant. But the 515 pages he received raise a question far bigger than one man's burger habit: how much does every major retailer in America already know about you, and what are they doing with it?
A McDonald's spokesperson defended the practice in a statement to Wired, as the New York Post reported:
"McDonald's takes data privacy and security seriously, and we take robust steps to safeguard customer information."
The spokesperson added that the company uses purchase history "to provide a more engaging, personal customer experience, like delivering the most relevant deals, offers and messages." Customers, the spokesperson said, "continue to have privacy choices available to them as outlined in our privacy statement."
That privacy statement, though, tells a broader story than "relevant deals." Stephanie T. Nguyen, a senior fellow at Columbia Law School's Center for Law and the Economy and a former chief technologist at the Federal Trade Commission, reviewed the policy and described its scope to the New York Post:
"If you study the McDonald's nearly 10,000-word privacy policy, it notes how the company can monitor a customer's precise geolocation, their browsing history, their app interactions, and their social media activity."
Geolocation. Browsing history. Social media activity. That goes well beyond tracking whether someone prefers a McChicken or a Big Mac. And Nguyen went further.
"They also publicly say they use this data to train its AI models and build profiles on its customers."
Nguyen's most pointed observation concerned the categories McDonald's claims it can model. She noted that the company's own policy language states it can predict "a consumer's preferences, their characteristics, their psychological trends, their predispositions, their behavior, their attitudes." Then she added a detail that stands out from the rest.
"They even say intelligence abilities and aptitudes."
She posed the question plainly: "How is McDonald's leveraging these psychological profiles about your intelligence and aptitudes to drive repeat customer engagement over time?"
McDonald's did not address that question in its statement. The spokesperson's comments focused on "relevant deals" and customer "privacy choices." The gap between those two framings, a company talking about coupons while its own policy describes psychological profiling, is worth sitting with.
Joseph Turow, a professor emeritus at the University of Pennsylvania's Annenberg School for Communication and author of "The Problem with Personalization," reviewed Rogers' findings and did not hold back:
"[It] boggles the mind. I mean, that's AI going crazy."
Turow warned against treating the McDonald's dossier as an isolated curiosity. "We ought to be concerned globally. This is one case," he said. "Imagine this going on in, you know, hundreds and hundreds of retailers across the United States, right? This is not a one-off."
His broader point cuts to the heart of the business model behind loyalty programs industry-wide. These programs are marketed to consumers as a way to earn free food, discounts, and rewards. What they actually do, at scale, is convert every purchase, every app tap, every sweepstakes scan into raw material for predictive algorithms that treat the customer as a subject to be studied, categorized, and retained.
Turow described the end goal in plain terms:
"McDonald's goal is to make its relationship with you so personalized that you will see yourself in their relationship with you."
Rogers, to his credit, did what most consumers never do. He asked to see his data. He read all 515 pages. He requested deletion. He said he would walk away from the chain entirely.
But Rogers is a journalist at a major national publication owned by Condé Nast. He had reason to dig, the tools to understand what he found, and a platform to publish it. The average McDonald's loyalty-program member, the parent grabbing Happy Meals on the way home from work, the truck driver pulling through the drive-through at 6 a.m., is not reading a nearly 10,000-word privacy policy. That customer has no idea a corporation is building a psychological profile on them, predicting their behavior down to the decimal point, and assigning them an attrition score of zero.
McDonald's Privacy Rights Center exists, and customers can submit data requests. That much is true. But a right that requires a consumer to navigate a corporate data-request portal, then read and interpret 515 pages of algorithmic output, is a right that exists mostly on paper.
Nothing in the available reporting indicates any pending regulatory inquiry, legal action, or legislative response to McDonald's data practices. No federal agency has weighed in. No state attorney general has opened an investigation. The FTC, where Nguyen once served as chief technologist, has not announced any review.
That silence is itself a data point. A fast-food company is openly stating in its own privacy policy that it monitors customers' geolocation, browsing history, app behavior, and social media activity, then uses that data to model their psychological trends, predispositions, and intelligence. And the regulatory apparatus charged with protecting consumers from deceptive or unfair business practices has, so far, said nothing.
Several questions remain unanswered. Whether McDonald's confirmed or denied the specific predictions in Rogers' file, the 2.16 visits, the $13.49 average, the zero attrition score, is unclear. Whether the behavioral categories assigned to Rogers are standard across all loyalty members or tailored to him individually has not been addressed. And whether McDonald's has fulfilled his deletion request remains unknown.
Americans who value their privacy and their autonomy deserve to know what corporations are doing with the data they hand over in exchange for a free McFlurry. Right now, the companies writing the algorithms are also writing the rules, and the people living inside those profiles have almost no idea they exist.