In August 2026, WIRED journalist Reece Rogers filed a data access request with McDonald's. As a California resident, he's legally entitled to a copy of everything the company holds on him. What came back was 515 pages, stamped with golden arches, covering years of his life.
The file went past order history into predictions. "Estimated Number of Visits During the Next 6 Weeks: 2.16." "Estimated Average Order Spend: $13.49." A "Customer Attrition Likelihood" score of zero, meaning McDonald's expected him to keep coming back forever. A behavioral archetype filing him under "Food-Led Afternoon Snack / On the Go Lunch in a Rush." His statistically most-ordered item: a Large Diet Coke.
One burger chain, one customer, 515 pages of history plus a forecast of his future behavior. If you've ever scanned the app for a free fries coupon, a version of this file exists on you too.
What McDonald's Owns Up To
None of this came from a leak or a hack. McDonald's US privacy policy says it collects your location using GPS, Wi-Fi, Bluetooth, or cell tower proximity. It captures video inside and outside restaurants. It logs "online activity on other websites, applications, or social media." It takes data from social media networks, data brokers, and payment processors. It uses all of it to market to you and to train its algorithms and AI models.
The same policy says McDonald's shares identifiers, usage data, and inferences drawn about you with social media, advertising, and analytics partners, and notes that under several state laws this counts as selling your personal information.
Some claims floating around go past what the policy says. It never mentions facial recognition, and "cell tower proximity" is a standard phone feature, not proof McDonald's buys telecom location records. The documented facts are big enough without the embellishment.
The Secret Score You'll Never See
McDonald's dossier follows an older and wider pattern: the customer lifetime value score. It estimates how much money a company can extract from you over years, and it shapes what offers you get, what rewards you're worth, and how you get treated. Unlike a credit score, no legal framework lets you view it, dispute it, or correct it.
McDonald's assigned Rogers a "Customer Group: CV2" tier and declined to explain what it means. Consumer Reports found Kroger runs a parallel operation: its data science subsidiary 84.51° holds tens of petabytes of loyalty-member data, scores tens of millions of households, and sells data-driven advertising to dozens of other companies. That unit pulled in roughly $527 million in profit in 2024. When one reporter requested his own Kroger profile, he got 62 pages, much of it wrong.
Hook, Hack, Hike
Stephanie Nguyen (Vanderbilt) and Sam Levine (UC Berkeley) published a framework last year naming what loyalty programs actually do, in three stages. The Hook: signup discounts to get you in. The Hack: extracting purchase patterns and measuring how much price pain you'll tolerate. The Hike: raising fees and cutting benefits once switching costs are high. Streaming services ran this playbook in public. Netflix launched its ad tier at $6.99, then raised it twice. Amazon made ads the Prime Video default and charged $2.99 more to turn them off. The coupon was the entry fee. The data was the product.
What Actually Works
You can't stop this industry from existing, but you can starve your file:
- Request and correct your file. In California and most of Europe you can request everything a company holds on you, and the corrections you submit change what marketers see. Start at any company's "Do Not Sell or Share My Personal Information" page.
- Pay cash where it counts. A named, card-tied purchase is a permanent record. Gift cards bought with cash break that link for digital orders.
- Use email aliases. Free alias services let every loyalty signup go to a different address, so your accounts can't be joined across companies.
- Revoke app permissions. Location, contacts, and background app access are the raw material. Turn off what you don't use.
- Lock down your network. Router-level ad and tracker blocking, DNS filtering, and keeping smart TVs and IoT gadgets on a separate network segment cut the "online activity on other websites" feed at the source, which is the part most people can't fix app by app.
That last one is The Fiber Dad's home turf. We set up network-wide tracker blocking and IoT isolation for Knoxville homeowners, so the data collection described in a fast-food privacy policy stops at your router instead of following your household around the web.
Every store wants you enrolled, logged in, and scanned. You're allowed to be the one customer whose file stays thin.
DM me if you want your home network checked for what's leaking.
Sources: WIRED, "McDonald's Built a 515-Page Dossier on Me" (Reece Rogers, Aug 2026); McDonald's US Privacy Statement (updated Jul 2026); Consumer Reports Kroger data investigation (May 2025); "The Loyalty Trap: How Loyalty Programs Hook, Hack, and Hike" (Nguyen & Levine, Vanderbilt/Berkeley, Oct 2025); Netflix and Amazon pricing histories via company help pages and public reporting.