McDonald’s uses customer data to predict future visits and spending. One journalist wanted to see what they had on him: ‘Received a 515-page file’

A journalist who asked McDonald’s for a copy of his personal data says he was sent a file that ran 515 pages long. The report, he said, included years of order history, loyalty points, and predictions about how often he would visit and how much he would spend.

Reece Rogers, a reporter at Wired, made the request through McDonald’s Privacy Rights Center. As a California resident, he has a legal right to ask companies what personal data they hold on him, under the California Consumer Privacy Act.

A few days after submitting the request, Rogers got a response. “I received a 515-page file in my inbox with the iconic golden arches stamped across the top,” he wrote. He said he had signed up for the McDonald’s loyalty program through the app mainly to get food deals, and later found the data collected through the app was being used to predict his future behavior as a customer.

The data included detailed purchase history and future spending estimates

According to the report Rogers received that he attached to his Wired post, McDonald’s had recorded nearly every transaction he made through the app, along with offers sent to him and the loyalty points he earned. The file also logged every time he scanned a code as part of the McDonald’s Monopoly sweepstakes, along with any prizes he won.

The report also included predictions generated by McDonald’s algorithms. It estimated that Rogers would visit McDonald’s 2.16 times over the next six weeks, spend an average of $13.49 per visit, and spend $29.15 in total during that period. It also listed a large Diet Coke as his most frequently repurchased item.

McDonald’s used labels to describe his shopping patterns, such as “Food-Led Afternoon Snack” and “On the Go Lunch in a Rush.” The report also gave him an “attrition” score of zero, which may indicate the company predicts he is unlikely to stop being a customer. McDonald’s says it uses data to personalize experiences, though the practice has drawn scrutiny, as a worker described a customer placing the same order daily in a real-life SpongeBob scam. 

A McDonald’s spokesperson told Wired, “McDonald’s takes data privacy and security seriously, and we take robust steps to safeguard customer information.” The spokesperson added, “Like many digital loyalty programs, we use information such as past purchases to provide a more engaging, personal customer experience, like delivering the most relevant deals, offers and messages. Our customers continue to have privacy choices available to them as outlined in our privacy statement.”

Lorrie Cranor, a professor at Carnegie Mellon University and director of the CyLab Security and Privacy Institute, said the report’s length should serve as a wake-up call for consumers. “The 500 pages is kind of a wake-up call,” Cranor said. “But it’s not in a format that people will readily understand.” She said companies could better inform customers by explaining, at the time of sign-up, what data will be stored and how it will be used.

Ryan Calo, a professor at the University of Washington and a faculty cofounder of its Tech Policy Lab, described the imbalance between customers and companies that operate loyalty programs and apps. “You’re mediated by the technology,” Calo said. “You’re going through their drive-thru. You’re using their kiosk. You’re using their app. You’re in their ecosystem, and they have a bunch of people with letters after their names trying to design it in a way that maximizes profit.”

Ari Ezra Waldman, a professor of law at UC Irvine, said that individual pieces of data may not seem sensitive on their own, but the pattern that forms over time can reveal a lot. “You eating this burger or liking that musician itself may not be private, but the aggregation and collection of this information, as well as its processing through AI, can create pretty invasive and personal information about when you’re going to be there, what you do during the day, and so forth,” Waldman said.

After reviewing the report, Rogers returned to the McDonald’s Privacy Rights Center and requested that the company delete the data it had stored on him. He also said he planned to stop eating at McDonald’s, though added that his decision was not driven by shame or a wish to eat healthier. Rogers is not alone in his negative experiences with the fast-food chain, as customer service disputes are also documented. 

Following Wired’s report, tech outlet Futurism compared the size of the file to records held by the FBI, noting that 515 pages is close to what the agency generally considers a “large” case file, comparable in length to its file on John Lennon. Futurism also referenced an earlier data leak involving McDonald’s hiring chatbot, which had exposed personal information belonging to around 64 million job applicants.