What's in the file

Reece Rogers, the same WIRED reporter behind the 100-company access-request investigation this desk covered previously, requested his own data from McDonald's through its Privacy Rights Center — the company's version of the access-request mechanism California and 20-plus other states now require. What came back: a 515-page file.

Inside: years of his purchase history, his loyalty-points record, his account activity, every promotional offer tied to his account, and every McDonald's Monopoly game code he'd scanned. That alone is a large file. What made it notable wasn't just the volume — it was what McDonald's had built from it. The company's own predictive models estimated Rogers would visit 2.16 times over the next six weeks, spend $13.49 on average per order, and — per the figure in his file — put his odds of ever leaving the brand at zero percent. The file ranked his most relevant menu items, topped by a large Diet Coke and a spicy snack wrap, and slotted him into named behavioral segments, including "Food-Led Afternoon Snack" and "On the Go Lunch in a Rush."

Jeff Chester, executive director of the Center for Digital Democracy, put the underlying mechanism plainly: "McDonald's secret sauce is really commercial surveillance." McDonald's, in a statement to WIRED responding directly to this reporting, said: "Like many digital loyalty programs, we use information such as past purchases to provide a more engaging, personal customer experience — like delivering the most relevant deals, offers and messages." That's a description of the purpose, not a rebuttal of the scale.

The legal record — one settled, one closed without resolution

McDonald's has faced two separate Illinois biometric-privacy matters, on opposite sides of the counter, and they landed differently.

Employees — settled: In 2021, current and former Illinois McDonald's employees alleged the company's restaurant systems collected biometric data — through login systems that used fingerprint or similar scans — without the written consent and retention disclosures the Illinois Biometric Information Privacy Act (BIPA) requires. McDonald's and its franchisees agreed to settle for up to $50 million: a $40 million base fund plus two additional $5 million reserves that release if participation thresholds are met. The settlement received preliminary approval in late 2021, with payouts of up to $375 for employees who worked before Dec. 31, 2018, and up to $190 for those who started after — actual amounts depending on how many employees filed claims. McDonald's did not admit wrongdoing under the settlement; the underlying BIPA allegations were never adjudicated.

Customers — closed, no finding either way: Separately, Illinois resident Shannon Carpenter sued McDonald's in 2021 (Carpenter v. McDonald's Corp., No. 1:21-cv-02906, N.D. Ill.), alleging its AI-powered drive-thru voice-ordering system collected customers' voiceprints and combined them with license-plate scanning to identify repeat visitors — again without the consent BIPA requires. McDonald's denied collecting biometric data at all, arguing in its defense that the technology Carpenter cited "does not describe technology that uses biometric information," only a natural- language ordering system. The case ended July 12, 2023, when both sides filed a joint stipulation dismissing it — no settlement was disclosed, each side covered its own costs, and neither side's version of the facts was adjudicated.

Both matters are now closed. One ended with McDonald's paying a real, structured settlement to a class of employees; the other ended with McDonald's customers' central factual dispute — did the drive-thru system fuse voice and plate data into an identity profile — never resolved one way or the other.

What this piece is not saying

This isn't claiming the $13.49/2.16-visit/zero-percent figures in Rogers's own file describe anyone else's file — one customer's profile isn't evidence of what any other McDonald's customer's data says. It isn't asserting the loyalty-app profiling itself broke any law; nothing here alleges McDonald's collecting and predicting from purchase history violates a statute, and the reporting this piece is built on doesn't make that claim either — the story is the scale and specificity of what's legal, not an accusation of illegality. It isn't saying the Carpenter dismissal means the underlying voiceprint-and-plate-fusion allegation was false, or that it was proven true — a joint stipulated dismissal with no disclosed settlement resolves the case without resolving the factual dispute at its center. And it isn't treating the employee settlement and the customer lawsuit as the same claim — one involved workplace login systems and ended in a real payout; the other involved drive-thru ordering technology and ended with nothing paid and nothing decided.

What can I do

Go to McDonald's Privacy Rights Center directly: privacyportal-mcdonalds.my.onetrust.com — confirmed live and working. Select your country (United States), enter and confirm your email, and clear the CAPTCHA. From there, expect a request-type choice — pick "Right to Know" / "access my data," not deletion, if you want the file itself. McDonald's will likely verify your identity by email before it processes anything; that's normal, not a snag. Turnaround runs several weeks, not days — Rogers's own request took roughly that long.

If you'd rather not use the web form, McDonald's franchisee-privacy materials list franchising@us.mcd.com or 888-511-9903 as alternate contacts, though the web form is the more directly confirmed consumer route.

If you're an Illinois resident and believe a McDonald's location collected your fingerprint, voice, or another biometric identifier without the written consent BIPA requires, that law still gives you a direct right to sue — though, per the companion piece on Walmart's litigation, a 2024 amendment now caps what a single claim can recover to one violation per person per method of collection, not one payout per scan.

Why this is a BL:UF story

This is the second entry in The Ledger — an ongoing record of what named retailers actually collect, one company at a time, in their own words and their own court filings. McDonald's is the clearest example yet of the split this series keeps finding: a loyalty app that legally builds a 515-page psychological profile of one regular customer, sitting in the same company that has already paid real money over a different, unauthorized kind of tracking, and fought off — without resolving — an allegation that its drive-thru does something similar. The profiling nobody technically broke a law to build is, in its way, the more unsettling entry: no lawsuit required, just a form nobody reads.

The Receipts