When I first downloaded the McDonald’s app years ago, I didn’t think of myself as making a serious decision. I was just hungry, a little broke, and very interested in the promise of a free McFlurry or a discounted Big Mac if I signed up for the loyalty program. I tapped through the registration process as quickly as I could, unwittingly nodding along to pages of legalese, and told myself that the trade-off was reasonable: give a fast-food chain a little information about my habits, get cheaper food in return. Why not? Everybody does it. But as I would later discover, the real price of those cheap fries was far more complex than I imagined. I understood, vaguely, that my purchases were being tracked. I did not understand that the company was building a predictive model of my behavior—one capable of anticipating what I might want next, where I might want it, and how likely I was to be swayed by a well-timed coupon. The full picture only came into focus after I realized that, as a California resident, I had a legal right to ask McDonald’s for a copy of the data it stored on me. I decided to request that information, not because I expected anything surprising, but because I wanted to see what one of the most recognized fast-food companies in the world actually does with all the digital crumbs we leave behind. A few days after I submitted my request through McDonald’s Privacy Rights Center, an email arrived. Attached was a PDF, 515 pages long, with the golden arches stamped across the top of the page. It was one of the strangest documents I have ever opened. It was my life in fast food, collected and compiled by algorithms I had never seen and never agreed to in any meaningful way.
What made the report so unsettling was not that it contained a single shocking secret. It was that the file was almost entirely made up of the kind of information you might assume is too trivial to matter. There was a detailed record of every McDonald’s transaction I had made over the years, listed line by line, with dates and times and store locations I didn’t even remember visiting. It showed every offer the company had sent me, whether I clicked on it, whether I used it, and how many loyalty points I had accumulated along the way. It even logged the times I had scanned a code for the returning Monopoly sweepstakes, and the prizes I was awarded, most of which were nothing more than a free order of fries or a chance to play again. Reading through it felt strange because the report wasn’t just a list of receipts. It was a behavioral diary. Every time I opened the app to satisfy a craving, I was generating a tiny piece of information about myself—where I was, what time of day I ate, which menu items caught my eye, and what price point was finally enough to make me cave. In aggregate, those tiny observations formed a portrait of me as a consumer, and that portrait had been used to decide what messages to show me in the future. I had thought of the McDonald’s app as a convenience, a digital wallet for hamburgers. But from the perspective of the corporate systems that generated that 515-page file, it was something closer to a research instrument, and I was the subject of the experiment.
Privacy scholars and consumer advocates have a name for this: commercial surveillance. Jeff Chester, executive director of the Center for Digital Democracy, put it bluntly when I spoke with him about my report. “McDonald’s secret sauce is really commercial surveillance,” he said. That phrase stayed with me because it reframed everything I had experienced. The secret sauce isn’t the special flavor of the burger; it is the system that turns ordinary people into predictable customers. When you sign up for a loyalty program, you get points, but the company gets something even more valuable: a continuous, detailed stream of information that can be combined with other data sources to build a model of who you are and how you behave. Privacy experts I consulted were careful to note that what McDonald’s did with my data was not particularly abnormal. It is fairly standard for how large American companies run their loyalty programs. Retailers, grocery stores, coffee shops, and airlines all do it. They are all in the business of knowing you better than you might know yourself. For a fast-food chain, that means tracking whether you tend to visit on weekday afternoons or late weekends, whether you prefer cold drinks or hot ones, and whether you respond to discounts or you’re willing to pay full price. The word companies use for this is “personalization,” but personalization is essentially prediction. The goal is to anticipate your needs, shape your desires, and gently guide you toward the purchase that maximizes the company’s profit. That doesn’t mean it is malicious, but it does mean that every notification that appears on your phone was designed to influence you.
The process of actually making sense of my file was almost as revealing as the file itself. Because the document was so long and written in a format that read more like a database export than a story, I had to use generative AI tools to help me extract the key information. Then I went back to the original document to verify the details, and I spoke with experts to fill in the gaps. There was something deeply strange about needing software to understand what another company’s software knew about me. The report’s introduction said that the information included “specific pieces of personal information about you” that were identified by searching McDonald’s systems. Reading those words, I realized how thoroughly a corporate database can reduce a person to a set of variables: purchase timestamps, store visit frequency, promotion redemption rates. The report also reminded me that this information didn’t just sit in a file somewhere. It had been used, in real time, to send me the messages that appeared in my app. The offers were not generic. They were individually targeted, based on what the system had learned about my habits. Every time I scanned a code, every time I saved a coupon, every time I placed an order, I was teaching the algorithm what worked and what didn’t. When I reached out to McDonald’s about all this, a spokesperson sent WIRED a statement saying that the company takes data privacy and security seriously and uses information like past purchases to provide a more engaging personal customer experience, while still offering customers privacy choices. That response is probably sincere, but it doesn’t change the underlying mechanics. The customer experience is personalized precisely because the customer has been made legible to a predictive system.
The broader lesson here is about the hidden architecture of American consumer life. When you sign up for a loyalty program, you are making a deal, but the terms of that deal are almost always bafflingly one-sided. You get a discount. The company gets the ability to build a predictive profile of you. That profile can be used to decide what offers you receive, when you receive them, and how aggressively the company tries to change your behavior. It can also be combined with information from other sources, inferred from your choices, and used to make assumptions about your habits, resources, and preferences. For example, if you frequently buy late at night, the system may infer that you have irregular working hours. If you often buy children’s meals, it may infer that you have kids. If you usually buy the cheapest item on the menu, it may infer something about your financial situation. On their own, these observations seem harmless. But together, they form a fine-grained map of a life, and maps can be used in ways the mapped person may never know. I was lucky because I live in California, where privacy laws gave me the right to request this information. Most people in the United States do not have that same access. Even when they do, the reports they receive can be so dense and confusing that they need artificial intelligence to help decipher them. That is not a functioning system of informed consent. That is a system in which the burden is placed on ordinary people to catch up with machines that have been studying them for years.
So what should we do with all of this? I don’t think the answer is to swear off fast-food apps and loyalty programs forever. I still have the McDonald’s app on my phone, and I suspect I’ll still use it the next time I get a craving for fries. But the experience of receiving that 515-page file has permanently changed the way I understand the transaction. Every time I tap “order,” I now remember that I am not just buying a meal. I am also updating a database that knows my habits, my routines, and my weak points. The old saying goes that if you are not paying for the product, you are the product. But even when you are paying for the product—and a Big Mac isn’t free—your attention, your behavior, and your future choices are still the currency being traded behind the counter. There is something almost poetic about the fact that the McDonald’s report was full of details about tiny, forgettable decisions: a soda upgrade here, a side of fries there. Those small choices added up to a portrait that I could barely recognize, because I had never seen myself through the eyes of a predictive algorithm. In a way, the report was a mirror, but it was a mirror built by a corporation for its own purposes. It showed me how I appear to the machines that help sell fast food. It did not show me who I actually am. That distinction matters, and it is worth remembering every time we are tempted by the promise of free food in exchange for a little data. The next time you sign up for a loyalty program, take a moment to wonder what happens after you tap “agree.” The answer might be a 515-page file that knows you better than you know yourself.
