Reece Rogers wanted deals. He downloaded the McDonald’s app years ago. What he got back recently was something else entirely. A 515-page document. Stamped with the golden arches. Packed with predictions about his next orders, his likely visits, even his zero chance of walking away.
The WIRED story broke yesterday. Rogers, a service writer at the publication, had filed a simple data request through McDonald’s Privacy Rights Center. Days later the file landed in his inbox. “This report contains specific pieces of personal information about you that were identified by searching McDonald’s systems which contain information about our customers,” it began. Clinical. Corporate. And unnervingly complete.
Short list of what sat inside. His transaction history. Every offer pushed his way. Loyalty points earned and spent. A full record of Monopoly sweepstakes scans and prizes won. Then the analytics layer. Estimated visits over the next six weeks: 2.16. Average order spend: $13.49. Total projected spend: $29.15. Customer attrition likelihood: zero. The system had slotted him into group CV2. His top occasions? “Food-Led Afternoon Snack” and “On the Go Lunch in a Rush.” Most visited spots: San Francisco and Santa Barbara, 61 times between them. Top product by recency, frequency and monetary value: a large Diet Coke. Top category: Wraps–Chicken.
The ten products McDonald’s ranked as most relevant to him ran from that Diet Coke at number one down through Spicy Snack Wrap, Grinch McShaker Fries, Double Cheeseburger, and all the way to a 20-piece McNuggets in tenth place. These scores don’t come from guesswork. They emerge from layers of transaction data run through models that infer habits, forecast behavior, and shape the next coupon. The company knows when he rushes, when he snacks, what he skips.
But here’s the twist. Rogers isn’t some extreme case. Privacy experts told WIRED the depth feels invasive yet tracks standard practice for big loyalty programs. Jeff Chester, executive director at the Center for Digital Democracy, put it bluntly. “McDonald’s secret sauce is really commercial surveillance.” The aggregation turns ordinary purchases into a portrait that predicts where someone will be and what they will crave.
Ari Ezra Waldman, professor of law at the University of California, Irvine, added context in the same piece. “You eating this burger or liking that musician itself may not be private, but the aggregation and collection of this information, as well as its processing through AI, can create pretty invasive and personal information about when you’re going to be there, what you do during the day, and so forth.” The power sits with the company. The customer rarely sees the full picture until a request forces it out.
McDonald’s responded to WIRED with a measured statement. “McDonald’s takes data privacy and security seriously, and we take robust steps to safeguard customer information. Like many digital loyalty programs, we use information such as past purchases to provide a more engaging, personal customer experience—like delivering the most relevant deals, offers and messages. Our customers continue to have privacy choices available to them as outlined in our privacy statement.” The company points to its global customer privacy statement and the rights portal Rogers used. Deletion requests are honored. Yet the file itself reveals how much has already been built.
Recent coverage echoes the shock. Gizmodo ran the headline “Your McDonald’s File Is Probably Bigger Than Your FBI File” the same day. It framed the dossier as a trove that predicts behavior more precisely than many expect from a burger chain. CBS News Chicago carried a segment on the 500-plus-page report, noting how dining habits become data assets. And MLQ News highlighted the predictive math: 2.16 visits, $13.49 average ticket, zero attrition risk. The same numbers, different outlets. The story spread fast.
Look closer at McDonald’s own policies. Its privacy notice describes three buckets of information: what customers provide, what systems collect automatically, and what arrives from other sources. Location data from app use, purchase timestamps, device identifiers. All feed the models. A separate consumer health data policy updated in March 2024 addresses complaints involving health conditions, but the loyalty file Rogers received focused on eating patterns. Still, the line between preference and profile blurs.
Rogers requested deletion after reviewing the pages. The episode leaves larger questions. How many customers realize their lunch choices generate forecasts this granular? How do these profiles influence pricing, offers, even restaurant placement over time? Loyalty programs once traded points for data. Now they trade data for predictions that lock users in. Attrition likelihood of zero isn’t marketing fluff. It’s a signal the model believes this customer stays.
Industry watchers note the imbalance. Companies hold the complete record. Individuals get glimpses only when they ask, and even then the output can overwhelm. Rogers’ file ran hundreds of pages because it logged years of activity plus derived scores. Multiply that across millions of app users. The scale becomes clear. Fast-food chains sit on behavioral databases rivaling those of tech giants. They just sell burgers alongside the insights.
And the predictions keep refining. Each scan, each skipped offer, each rush-hour purchase tightens the model. The document Rogers received already knew his patterns cold. Future versions will likely sharpen further. So he keeps the app for now. Deals still arrive. But the dossier sits as a reminder. Every meal leaves a mark. McDonald’s remembers them all.
Regulators and advocates push for clearer disclosures. They want companies to spell out not just what data is gathered but how inferences are drawn and how long profiles persist. McDonald’s says choices exist. The file shows how much those choices have already fed into the system. The conversation is only beginning. One 515-page report at a time.