I requested a copy of my data from McDonald’s loyalty program

As a California resident, I possess the legal right to access data companies store about me. Consequently, I requested such information from McDonald's to better comprehend the extent of data collection by major fast-food chains. After submitting a request through the McDonald’s Privacy Rights Center site, I received a 515-page file in my inbox, marked with the well-known golden arches.

Loyalty programs, like the one offered by McDonald’s, may not fully disclose the breadth of data collection and its usage in predictive models. Jeff Chester, executive director of the Center for Digital Democracy, asserts that McDonald’s data collection practices can be likened to "commercial surveillance." Privacy experts confirm that this level of detail is standard for large U.S. companies managing loyalty programs.

The document provided by McDonald’s contained extensive personal information derived from their systems, detailing customer interactions. It took me some time to decipher, so I employed a generative AI tool to extract key information. Upon verification with the original document and consultation with privacy experts, I gained a clearer understanding.

McDonald’s asserts that they prioritize data privacy and security, employing measures to safeguard customer information. They use historical transaction data to deliver personalized experiences, such as relevant deals and offers. The data report revealed intricate details about my past McDonald’s transactions, the offers I received, and the loyalty points accumulated over years of usage.

From the data, McDonald’s estimated the number of visits, average order spend, and total predicted value for the next six weeks. Additionally, it classified my customer group based on historical transactions and identified the most transacted occasion type as a food-led afternoon snack or an on-the-go lunch in a hurry. The report also assigned me a customer group called "CV2" with no indication of what it signifies.

Moreover, McDonald’s categorized my most transacted occasion type as "Food-Led Afternoon Snack" or "On the Go Lunch in a Rush," identifying Large Diet Coke as my most frequently purchased item. They also labeled my core purchasing habits as getting a "Food-Led Afternoon Snack" or an "On the Go Lunch in a Rush." The report listed my "attrition" score as zero, implying a lifelong customer relationship with McDonald’s.

The sheer volume of data stored by McDonald’s over the years left me surprised, but it was the utilization of this data by their predictive algorithms that raised concerns. The company projected the frequency of visits, average spend, and total predicted value for the next six weeks. Beyond the numbers, the data also revealed my preferences, such as the large Diet Coke being my favorite item and the "Food-Led Afternoon Snack" or "On the Go Lunch in a Rush" being my typical purchasing habits. Notably, the report assigned me a customer group "CV2," yet lacked any explanation of its meaning.

The data collection process highlights a significant power imbalance between consumers and large companies, leaving users susceptible to long-term surveillance. While individual data points appear innocuous, the overall analysis reveals potential dangers of such data-driven practices.