What McDonald's does with your data

What it collects and does with your data

• McDonald's announced a media network; since August 2026, 450 company-owned U.S. restaurants show other companies' ads on digital drive-thru boards. Goal: a $1B business. Franchised restaurants not yet included.
• Privacy statement says McDonald's may use drive-thru audio and video to receive and process orders and to improve its technologies and operations, and captures CCTV inside and outside restaurants.
• Rewards disclosures list inferences drawn to create a profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.
• McDonald's says it does not disclose Rewards data to data brokers, but may disclose email addresses, pseudonymized identifiers, usage data, and inferences to social media, advertising, and analytics partners, which may be a sale under state law; data brokers are listed as a source.
• Site banner says the privacy statement is being updated to reflect how McDonald's may partner with select advertising partners.

Sensitive data

• drive-thru audio and video (used to improve technology)
• precise location
• payment
• inferences on intelligence and aptitudes

Enforcement and litigation

1 matter in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• Carpenter v. McDonald's (N.D. Ill.): BIPA class action alleging the AI drive-thru voice system collected voiceprints; claims were split between federal and state court; the federal case was dismissed by joint stipulation. Outcome of the remanded state claims not found.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: not estimable. Not estimable: franchisees operate most U.S. restaurants under their own privacy practices; ad partners not named.

Third parties: Named: franchisees (independent, not covered by the statement); food delivery platforms. Categories not counted.

Data brokers linked to McDonald's

• Gets customer data from data brokers it doesn't name. "McDonald's says it does not disclose Rewards data to data brokers, but may disclose email addresses, pseudonymized identifiers, usage data, and inferences to social media, advertising, and analytics partners, which may be a sale under state law; data brokers are listed as a source."

Confidence: confirmed means the company confirmed it or reported it in a filing. Alleged means a complaint or petition says so, with no ruling found. Reported means journalism or a Senate letter. How brokers are included

Data practices score

7 of 15. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

0

Retail media scale

1

Sensitive data

3

Opt-out friction

1

Estimated emissions for one person

Research gaps

• No media network revenue.
• U.S.-only loyalty count not disclosed.
• No email frequency data.
• Status of Carpenter claims remanded to state court not found.