A WIRED Reporter Requested Her McDonald's Data. The Company Sent Back 515 Pages Predicting Her Next Order.

A WIRED reporter downloaded the McDonald's app for cheap fries. Years later, she asked the company what it actually knew about her.

The answer: 515 pages.

Using her rights under the California Consumer Privacy Act, the reporter requested her personal data file through McDonald's Privacy Rights Center. What came back wasn't a simple order history. It was a predictive profile, according to WIRED.

The file estimated she'd visit McDonald's 2.16 times over the next six weeks, spend $13.49 per order, and rack up $29.15 in total predicted spending. Her "Customer Attrition Likelihood" score: zero. McDonald's models put the odds she'd stop being a customer at essentially nothing.

The report also sorted her into an internal "Customer Group" labeled CV2, a tier McDonald's doesn't explain to the customer. It tracked her "Most Transacted Occasion Type" (Food-Led Afternoon Snack, On the Go Lunch in a Rush), her most-visited locations (San Francisco and Santa Barbara, 61 visits), and her top product by an algorithm called Recency, Frequency, Monetary: a Large Diet Coke.

Jeff Chester, executive director of the Center for Digital Democracy, told WIRED this level of tracking is McDonald's actual business model. "McDonald's secret sauce is really commercial surveillance," Chester said.

The privacy experts WIRED spoke with said none of this is unusual. Loyalty programs across retail and restaurant chains build similar behavioral profiles. What's different here is scale, and that scale is about to get much bigger.

According to geekspin.co, McDonald's CEO Chris Kempczinski told investors on an August 4 earnings call that the company is consolidating customer data from 70 global markets into a single unified "data lake" to train a new AI system on the purchase habits of roughly 220 million active loyalty users.

The MyMcDonald's Rewards program generated more than $40 billion in sales over the trailing twelve months, per that reporting. Every transaction through it feeds the model: what customers order, when they visit, what price they paid, and whether a digital promotion actually worked.

Inside restaurants, McDonald's runs custom Google Cloud hardware called "Restaurant Platform Edge" that analyzes up to 120 real-time signals per order, including basket contents, loyalty tier, weather, local traffic, and kitchen capacity, refreshing every 10 milliseconds, according to geekspin.co, which cited a DigitalDefynd case study. Digital drive-thru menu boards reportedly update in under 80 milliseconds based on those signals.

A separate reinforcement-learning system reportedly optimizes pricing and item sequencing for margin and customer lifetime value. The system is built to maximize what McDonald's makes off you, not to guess what you'd actually prefer.

Separately, according to aiproductivelab.com, McDonald's has told investors it wants to grow its loyalty membership base from 175 million to 250 million users by 2027, and is layering in predictive maintenance sensors on kitchen equipment and AI tools across roughly 43,000 restaurants worldwide to cut downtime and improve order accuracy.

There's a real efficiency argument here. At 43,000 locations serving millions of people daily, small gains in order accuracy, equipment uptime, and relevant promotions translate into real savings and better service, according to aiproductivelab.com's analysis of McDonald's operations. Predicting fryer failures before they happen keeps menus fully stocked. Smarter drive-thru boards cut wait times. None of that requires bad faith.

The problem is the gap between what customers think they signed up for (a free rewards app, a discount here and there) and what's actually happening (a continuously updated behavioral score feeding a company-wide AI model). McDonald's disclosed this to investors on an earnings call. It did not send a press release to the 220 million people whose transaction histories are the raw material.

Consolidating data that was previously split across 70 separate markets into one repository raises an obvious risk: one breach now exposes everything, not just a regional slice.

That risk isn't hypothetical for McDonald's. In June 2025, security researchers Ian Carroll and Sam Curry found they could access up to 64 million job applicant records on McHire, McDonald's AI hiring platform run by third-party vendor Paradox.ai, according to geekspin.co. They got in through an admin portal protected by the password "123456."

That breach involved job applicants, not loyalty customers, and a different system. But it shows the company's security track record isn't spotless, and a single global customer data lake is a much bigger target than a hiring portal.

McDonald's has also not disclosed a Data Protection Impact Assessment for the consolidation effort, which geekspin.co reported could raise questions under the EU's GDPR rules once the company's European operations are folded into the same system. No EU regulator has opened an investigation into the plan as of this writing, and no charges or fines have been announced.

The open questions: what security standards will protect a single repository holding behavioral data on 220 million people, whether McDonald's will file the GDPR impact assessment European law may require, and whether customers outside California, who lack the same legal right to request their own file, will ever get to see what's in it.