As a California resident, I have the legal right to access the data a company stores about me. So, I decided to request that information from McDonald’s to better understand what one of the major fast-food companies is collecting about its customers. A few days after I visited the McDonald’s Privacy Rights Center site and requested access, I received a 515-page file in my inbox with the iconic golden arches stamped across the top.
Much of my data report contains a detailed account of past McDonald’s transactions as well as offers the fast-food company sent me and how many loyalty points I accumulated. Essentially, every time I opened up the app to grab a bite to eat, it created a detailed record about when, where, and what I purchased. The log was even more thorough than I anticipated, including a record of every time I’ve scanned a code as part of its returning Monopoly sweepstakes along with the prize I received.
While the sheer amount of data McDonald’s stored over the years caught me off guard at first, the way it was used by the company’s predictive algorithms was what I found most concerning. The company predicted how often I would visit in the next six weeks (2.16 times), what I would spend on average ($13.49), and what I would spend in total ($29.15). One reporter at WIRED joked that McDonald’s had created a Minority Report-style dossier to predict my next snack wrap purchase.
I don't eat at fast food restaurants often enough to be tracked, and I'm certainly not on anyone's loyalty plan, but I'm sure I would be very uncomfortable about the amount of information that...
I don't eat at fast food restaurants often enough to be tracked, and I'm certainly not on anyone's loyalty plan, but I'm sure I would be very uncomfortable about the amount of information that Amazon has on me.
I am very much a privacy enthusiast, but I don't see anything wrong or bad about this data. The export doesn't indicate any sort of data sharing—the profile McDonalds makes is only based on your...
I am very much a privacy enthusiast, but I don't see anything wrong or bad about this data.
The export doesn't indicate any sort of data sharing—the profile McDonalds makes is only based on your purchases at McDonalds, which are totally fine for them to track. The so-called "515-page dossier" is not as scary as it sounds, because it seems to just be a raw dump of CRM data, not some curated 515 page profile of the user. And the most scary exampled of the data they have is "here's your most bought product and a simple statistical analysis of your visits".
Personally, this kind of data doesn’t bother me at all, and is the type of data I don’t mind them having at all, and is the type of analysis I expect them to do. Using the data they have about my direct interactions with them to predict how I interact with them in the future seems fine. As long as they aren’t charging me extra, why should I be upset that they can predict what I will do based on my predictable behavior?
I guess for me it's the idea that large stores of data like that are liabilities that only increase in size and potential "severity" over time. Like, right now it's just McDonald's doing...
I guess for me it's the idea that large stores of data like that are liabilities that only increase in size and potential "severity" over time. Like, right now it's just McDonald's doing McDonald's things with our data, but if there were a breach, or if a data broker or AI company came along with the right price...
For example, Google just bought Spirit Airlines' data to train their AI. Granted, Spirit is defunct and the article claims that it doesn't include passenger information, but it still speaks to the idea that all this data could find itself somewhere else given the right circumstances, even if it currently isn't being used that way right now.
Take a guess as to what happened after the app was introduced and enough data was collected? They could hike prices because they knew the aggregated “pain point” prices that were juuuust still in...
As long as they aren’t charging me extra
Take a guess as to what happened after the app was introduced and enough data was collected?
They could hike prices because they knew the aggregated “pain point” prices that were juuuust still in reach of customers’ wallets without driving them away completely.
Exactly. When people started to talk about McDonalds becoming expensive there were always people saying “you can still get good deals if you use the app.” No, that means that the price is still...
Exactly. When people started to talk about McDonalds becoming expensive there were always people saying “you can still get good deals if you use the app.”
No, that means that the price is still up, you are just subsidizing them with the sale of your personal information, and furthermore you’re getting a terrible deal.
I don't understand how that's related to gathering data about individual customers. They're adjusting prices for everyone, not just for specific people. They could've done this by tracking regular...
I don't understand how that's related to gathering data about individual customers. They're adjusting prices for everyone, not just for specific people. They could've done this by tracking regular metrics without having an app and a loyalty programme.
They did, for years! That's what's so crazy to me about all this privacy stuff, I work at an analytics company, we literally make the product that people use to analyze this sort of stuff. You...
They did, for years!
That's what's so crazy to me about all this privacy stuff, I work at an analytics company, we literally make the product that people use to analyze this sort of stuff. You know how people actually use the product we make? They don't. They import their data, set up the feature, make 1 dashboard and then no one ever looks at it. I know this because we find bugs all the time which have been obvious blockers and they get missed for weeks. No one is actually looking at these reports.
They collect all this data. Make all these reports. Then whoever's supposed to look at the reports doesn't and makes a decision based on vibes.
I mean, yeah, they could, but they're just as likely to lower prices for the same reason after suddenly gaining access to that data. The whole point of data like that is to find the optimal price...
They could hike prices because they knew the aggregated “pain point” prices that were juuuust still in reach of customers’ wallets without driving them away completely.
I mean, yeah, they could, but they're just as likely to lower prices for the same reason after suddenly gaining access to that data. The whole point of data like that is to find the optimal price point. Its not the absolute most that a single customer is willing to pay. Its the price that most people are willing to pay that causes you to make the most profit over time.
If you price your big macs at 20 dollars, sure, some people are going to keep buying them, but most people won't, and you'll lose money. If you nudge the price up by only a little bit, you'll make more profit, but people will come less often. Finding the sweet spot where those two lines intersect is the whole point.
I tend to agree for the most part. It's probably a net positive for society if a restaurant can accuratey predict how much food should be prepared any given day and what amount of ingredients...
I tend to agree for the most part.
It's probably a net positive for society if a restaurant can accuratey predict how much food should be prepared any given day and what amount of ingredients needs to be stocked to accomplish that, etc. Wasting resources is really problematic for our environment.
As long as they're not making an extra buck out of selling this data to others for targeted advertising, it's fine.
AFAIK restaurants everywhere have always been perfectly fine to do this without collecting information about individual customers. They just look at the trends of what they sell.
AFAIK restaurants everywhere have always been perfectly fine to do this without collecting information about individual customers. They just look at the trends of what they sell.
Other people have responded to you similarly as I will: it’s aggregate data that is the problem. You can be sure that McDonald’s will either sell this data or have it leaked in a hack. Then one...
Other people have responded to you similarly as I will: it’s aggregate data that is the problem.
You can be sure that McDonald’s will either sell this data or have it leaked in a hack.
Then one day you’ll be denied health insurance because you eat too many burgers.
I'm gonna do a GDPR request to see how the EU branches of McDonalds are doing. From what I see, while the data collected is vast, it seems at the very least focused on selling you more burgers and...
I'm gonna do a GDPR request to see how the EU branches of McDonalds are doing.
From what I see, while the data collected is vast, it seems at the very least focused on selling you more burgers and fries.
Usually when mass data collection happens, I'm more scared of them correllating it and trying to figure out things that don't relate to their business so they can sell it to advertisers or third-parties. They still could do that and simply not share it, though.
EDIT: Since I live in a seventh-world country (Romania), I have to email them and wait for a person to reply. I expect for that to not happen.
You don't live in "seventh-world" country - you are EU citizen, you are at the top when it comes to stuff like this. They'll give you the data, GDPR fines are insane.
You don't live in "seventh-world" country - you are EU citizen, you are at the top when it comes to stuff like this. They'll give you the data, GDPR fines are insane.
The seventh world joke was because McDonalds has an online portal for most of its markets in the EU - but Romania isn't included there, and McDonalds Romania says in their Privacy Policy to send...
The seventh world joke was because McDonalds has an online portal for most of its markets in the EU - but Romania isn't included there, and McDonalds Romania says in their Privacy Policy to send an email to gdpr@ro.mcd.com.
Not all EU countries are treated equally by corporations unfortunately, but yeah, they should still abide by GDPR rules.
They still need to provide you the data in the same time period as any other EU citizen. If they don't, I strongly recommend you report them. The EU does not fuck around when it comes to GDPR. If...
They still need to provide you the data in the same time period as any other EU citizen. If they don't, I strongly recommend you report them. The EU does not fuck around when it comes to GDPR. If you don't get the data within 30 days, fill this:
Yeah, I know the process and plan on following it through if McDs doesn't respond. The Romanian branch is somewhat mismanaged and there's a non-zero chance of them fucking it up, so let's see what...
Yeah, I know the process and plan on following it through if McDs doesn't respond. The Romanian branch is somewhat mismanaged and there's a non-zero chance of them fucking it up, so let's see what happens.
Semi-related, I was looking online to see how GDPR enforcement has went since it went into effect, and apparently none of the larger fines have been collected yet, with all of them still in appeals or annulled entirely. I'm curious in 4-5 years how things lay out.
A lot of people don't seem to understand the significance of these practices even pointed out like this, and this is only a narrow profile of one customer at one company. And since they don't, it...
A lot of people don't seem to understand the significance of these practices even pointed out like this, and this is only a narrow profile of one customer at one company. And since they don't, it is easy collect data like this.
It seems that anything harmful at second or higher order effects or simply badly shoved out of view is simply ignored by the common person. The issue is the aggregate effects, how it further imbalances the relationship and how it shapes society.
I planned to add more of an explanation but I am tired.
Heres a fun personal fact about me, I actually stopped eating at McDonald’s before I became a health nut entirely because of their appification and invasive data harvesting practices. They are...
Heres a fun personal fact about me, I actually stopped eating at McDonald’s before I became a health nut entirely because of their appification and invasive data harvesting practices. They are very much not operating for the public good.
I eat at McDonald's probably a few times a year, but they don't know anything about me besides maybe my credit card number that I've paid with a few times. Hopefully they don't store that though....
I eat at McDonald's probably a few times a year, but they don't know anything about me besides maybe my credit card number that I've paid with a few times. Hopefully they don't store that though.
You don't have to give up your personal information or download an app to get a Big Mac though. I just don't buy things from places that make me use their stupid app even though I'm there in person.
I don't eat at fast food restaurants often enough to be tracked, and I'm certainly not on anyone's loyalty plan, but I'm sure I would be very uncomfortable about the amount of information that Amazon has on me.
I am very much a privacy enthusiast, but I don't see anything wrong or bad about this data.
The export doesn't indicate any sort of data sharing—the profile McDonalds makes is only based on your purchases at McDonalds, which are totally fine for them to track. The so-called "515-page dossier" is not as scary as it sounds, because it seems to just be a raw dump of CRM data, not some curated 515 page profile of the user. And the most scary exampled of the data they have is "here's your most bought product and a simple statistical analysis of your visits".
One comment from the HN discussion on this:
I guess for me it's the idea that large stores of data like that are liabilities that only increase in size and potential "severity" over time. Like, right now it's just McDonald's doing McDonald's things with our data, but if there were a breach, or if a data broker or AI company came along with the right price...
For example, Google just bought Spirit Airlines' data to train their AI. Granted, Spirit is defunct and the article claims that it doesn't include passenger information, but it still speaks to the idea that all this data could find itself somewhere else given the right circumstances, even if it currently isn't being used that way right now.
Take a guess as to what happened after the app was introduced and enough data was collected?
They could hike prices because they knew the aggregated “pain point” prices that were juuuust still in reach of customers’ wallets without driving them away completely.
Exactly. When people started to talk about McDonalds becoming expensive there were always people saying “you can still get good deals if you use the app.”
No, that means that the price is still up, you are just subsidizing them with the sale of your personal information, and furthermore you’re getting a terrible deal.
I don't understand how that's related to gathering data about individual customers. They're adjusting prices for everyone, not just for specific people. They could've done this by tracking regular metrics without having an app and a loyalty programme.
They did, for years!
That's what's so crazy to me about all this privacy stuff, I work at an analytics company, we literally make the product that people use to analyze this sort of stuff. You know how people actually use the product we make? They don't. They import their data, set up the feature, make 1 dashboard and then no one ever looks at it. I know this because we find bugs all the time which have been obvious blockers and they get missed for weeks. No one is actually looking at these reports.
They collect all this data. Make all these reports. Then whoever's supposed to look at the reports doesn't and makes a decision based on vibes.
Except now the AI makes their decision for them.
I mean, yeah, they could, but they're just as likely to lower prices for the same reason after suddenly gaining access to that data. The whole point of data like that is to find the optimal price point. Its not the absolute most that a single customer is willing to pay. Its the price that most people are willing to pay that causes you to make the most profit over time.
If you price your big macs at 20 dollars, sure, some people are going to keep buying them, but most people won't, and you'll lose money. If you nudge the price up by only a little bit, you'll make more profit, but people will come less often. Finding the sweet spot where those two lines intersect is the whole point.
I tend to agree for the most part.
It's probably a net positive for society if a restaurant can accuratey predict how much food should be prepared any given day and what amount of ingredients needs to be stocked to accomplish that, etc. Wasting resources is really problematic for our environment.
As long as they're not making an extra buck out of selling this data to others for targeted advertising, it's fine.
AFAIK restaurants everywhere have always been perfectly fine to do this without collecting information about individual customers. They just look at the trends of what they sell.
Other people have responded to you similarly as I will: it’s aggregate data that is the problem.
You can be sure that McDonald’s will either sell this data or have it leaked in a hack.
Then one day you’ll be denied health insurance because you eat too many burgers.
Maybe the problem is not McDonalds but American health insurance laws then.
I don’t see why we can’t blame all parties involved.
I'm gonna do a GDPR request to see how the EU branches of McDonalds are doing.
From what I see, while the data collected is vast, it seems at the very least focused on selling you more burgers and fries.
Usually when mass data collection happens, I'm more scared of them correllating it and trying to figure out things that don't relate to their business so they can sell it to advertisers or third-parties. They still could do that and simply not share it, though.
EDIT: Since I live in a seventh-world country (Romania), I have to email them and wait for a person to reply. I expect for that to not happen.
Lucky for you, they have to fulfill that request within about 30 days. :-)
You don't live in "seventh-world" country - you are EU citizen, you are at the top when it comes to stuff like this. They'll give you the data, GDPR fines are insane.
The seventh world joke was because McDonalds has an online portal for most of its markets in the EU - but Romania isn't included there, and McDonalds Romania says in their Privacy Policy to send an email to gdpr@ro.mcd.com.
Not all EU countries are treated equally by corporations unfortunately, but yeah, they should still abide by GDPR rules.
They still need to provide you the data in the same time period as any other EU citizen. If they don't, I strongly recommend you report them. The EU does not fuck around when it comes to GDPR. If you don't get the data within 30 days, fill this:
https://www.dataprotection.ro/servlet/ViewDocument?id=1548
Nothing would make me happier if I provided the link that ended up fucking over mcdonalds.
Yeah, I know the process and plan on following it through if McDs doesn't respond. The Romanian branch is somewhat mismanaged and there's a non-zero chance of them fucking it up, so let's see what happens.
Semi-related, I was looking online to see how GDPR enforcement has went since it went into effect, and apparently none of the larger fines have been collected yet, with all of them still in appeals or annulled entirely. I'm curious in 4-5 years how things lay out.
A lot of people don't seem to understand the significance of these practices even pointed out like this, and this is only a narrow profile of one customer at one company. And since they don't, it is easy collect data like this.
It seems that anything harmful at second or higher order effects or simply badly shoved out of view is simply ignored by the common person. The issue is the aggregate effects, how it further imbalances the relationship and how it shapes society.
I planned to add more of an explanation but I am tired.
Heres a fun personal fact about me, I actually stopped eating at McDonald’s before I became a health nut entirely because of their appification and invasive data harvesting practices. They are very much not operating for the public good.
I eat at McDonald's probably a few times a year, but they don't know anything about me besides maybe my credit card number that I've paid with a few times. Hopefully they don't store that though.
You don't have to give up your personal information or download an app to get a Big Mac though. I just don't buy things from places that make me use their stupid app even though I'm there in person.