Reece Rogers asked for his data. What arrived from McDonald’s stunned him. A 515-page file. Detailed predictions on his next order. Patterns in his visits. A profile so complete it claimed he would never stop eating there.
The Gizmodo report put it plainly. Private companies now hold dossiers on ordinary consumers that dwarf what federal agencies compile. And they build them not through warrants but through fries and app notifications.
Rogers, a reporter for Wired, downloaded the McDonald’s app years ago. He wanted cheaper meals. He got a digital shadow instead. The file tracked every scan during the chain’s Monopoly promotion. It ranked menu items he favored at different times of day. It forecast visit frequency, preferred locations, even probable orders. All generated by algorithms trained on his every transaction.
Short. Simple. Invasive.
California’s Consumer Privacy Act made the request possible. Residents can demand what companies know about them. McDonald’s maintains a dedicated portal for such inquiries. Rogers used it. The company complied. What he received showed how loyalty programs have evolved from punch cards to predictive engines. Points balances. Past orders. Tailored offers sent and ignored. Behavioral scores.
But. The predictions stood out. The report told Rogers exactly when and where he was likely to show up next. What he would buy. How often he would return. McDonald’s spokesperson told Wired the company “takes data privacy and security seriously” and employs safeguards for customer information. Yet the sheer volume told another story.
Consumers trade convenience for visibility. They accept it. Many even welcome the coupons. Yet few grasp the scale. One reporter’s file ran hundreds of pages. Multiply that across millions of users. The aggregate picture becomes staggering. Fast-food chains, coffee giants, grocery chains. All assemble similar profiles. They feed them into pricing models. Recommendation systems. Advertising platforms.
Geoffrey Fowler took a parallel step with Starbucks. The Washington Post described his findings. Eight pages of data. Enough to reveal potential surveillance pricing. The company appeared to offer him fewer discounts. Data suggested he would pay full price anyway. Loyalty programs, once marketed as mutual benefit, now function as surveillance tools. Discounts shrink for those the algorithms deem less price-sensitive.
A joint report from the Vanderbilt Policy Accelerator and UC Berkeley Center for Consumer Law and Economic Justice examined the pattern. Titled “The Loyalty Trap,” the document detailed how rewards schemes have shifted. Real perks fade. Data collection expands. Companies sell profiles to brokers. They test how much each customer will tolerate. That Vanderbilt report called McDonald’s approach a prime example. Behavioral data now sets prices, targets offers, and determines who gets the deal.
Consumer Reports exposed parallel practices at Kroger and Instacart. Some shoppers paid 25 percent more for identical items at the same moment. The difference? Their data profiles. History of purchases. Inferred willingness to pay. Location. The Consumer Reports investigation documented how loyalty cards quietly penalize certain buyers while rewarding others. Or so the algorithms decide.
And recent developments accelerate the trend. Maryland enacted the nation’s first ban on surveillance pricing for food retailers and delivery services. The prohibition takes effect October 1, 2026. It bars using personal data to raise prices on tax-exempt food items for specific individuals. Exceptions remain for genuine loyalty discounts and cost-based differences. The MultiState analysis noted the law’s narrow focus yet its symbolic weight. Other states watch closely. Federal proposals circulate.
Hogan Lovells attorneys highlighted the shift in a recent client alert. Congressional scrutiny now targets loyalty data monetization, location-based pricing, and algorithmic experiments. General counsel must prepare documentation that withstands hearings. The political momentum crosses party lines. That Hogan Lovells brief advised immediate compliance reviews. Assume regulators will demand methodology and data inputs.
McDonald’s privacy policy, updated as recently as July 2026, outlines broad collection. It covers app usage, restaurant visits, purchase details, location, and more. The company shares information with service providers, business partners, and in some cases for advertising. Customers can request access, deletion, or opt-outs. Yet the Rogers dossier demonstrated the volume possible even under current rules.
Data breaches compound the risk. In 2025 a McDonald’s hiring platform exposed records tied to 64 million applicants. Another incident involving Salesforce impacted 12.2 million customer contacts. Names, emails, addresses, phone numbers, and loyalty details appeared in samples circulating online. Claremont Graduate University researchers documented the hiring-system failure. ObscureIQ tracking flagged the customer records. No major U.S. customer breach was confirmed in every case, yet the pattern shows fragility.
So what happens when a private company knows you better than your bank? Or the government? The FBI maintains files on threats and investigations. They require legal process. Corporations collect on billions of routine purchases. No subpoena needed. Just a terms-of-service agreement most users never read.
The Vanderbilt authors captured the inversion. “In this game of Monopoly, the most valuable property isn’t on the board — it’s you.” Fast-food loyalty data now informs everything from menu engineering to targeted ads to dynamic offers. Profiles grow richer each year. Predictive models sharpen.
Regulators respond unevenly. The Federal Trade Commission pursues unfair practices around sensitive data and children’s information. State laws multiply. Europe’s fines, such as the millions levied against McDonald’s Polska for a breach, show enforcement appetite abroad. Yet in the United States, patchwork rules leave gaps.
Consumers face a choice. Delete the apps. Pay full price. Or accept the trade. Most choose the third path. Discounts prove hard to resist. Data flows continue.
Rogers’ experience offers a rare window. Most never request their file. They never see the predictions. The rankings. The quiet certainty that the algorithm has them figured out. McDonald’s says it safeguards the information. The dossier suggests the collection itself raises deeper questions.
Paper punch cards once sufficed. Buy ten sandwiches. Get one free. No profile attached. No future behavior forecast. That world has vanished. Today’s loyalty programs promise savings. They deliver surveillance at industrial scale.
Industry insiders already know the economics. Data improves retention. Refines offers. Boosts same-store sales. It also creates liabilities. Breach risks. Regulatory pressure. Public backlash when stories surface. The Rogers file made news precisely because it made the abstract concrete. Hundreds of pages. One customer. One fast-food chain.
Multiply across the sector. Starbucks. Kroger. Instacart. Each maintains its own trove. Some share with dozens of partners. The Vanderbilt report counted 64 entities for one Starbucks user. Data brokers. Advertisers. Analytics firms. The circle widens.
New Jersey, Maryland, and others test limits on personalized pricing. Bills distinguish between acceptable loyalty discounts and prohibited discrimination based on inferred characteristics. Enforcement will test those lines. Companies will adjust models. Arguments over “cost-based” differences will fill courtrooms.
Meanwhile, McDonald’s updates its privacy statement regularly. The July 2026 version stresses customer privacy matters. It details collection categories. It offers controls. Yet the 515-page reality for one user reveals the gap between policy language and lived practice.
Rogers put it succinctly in his Wired piece. He sought deals. He received a mirror. One that watches, remembers, and predicts. The rest of the customer base operates under similar terms. Invisible until someone asks.
That request changes everything. It turns abstract privacy concerns into tangible paper. Or PDF. Hundreds of pages long. Filled with inferences no human clerk could ever assemble. This is the new normal. Fast food knows you. Perhaps better than you know yourself.
And the file keeps growing. Every app open. Every code scanned. Every burger ordered. The dossier expands. The predictions refine. The cycle continues.