Your McDonald’s File is Probably Bigger Than Your FBI File

There is a massive dossier of all of your activity and behaviors used to create a detailed profile that predicts your behavior. And it’s not the intelligence agencies or law enforcement collecting it: it’s McDonald’s.

Wired reporter Reece Rogers requested the information that the fast food giant had stashed on him, and received a 515-page report that included predictions on how often he’d frequent the restaurant, when and where he was most likely to visit, and what he was most likely to order.

Rogers was able to get his hands on the stash of data thanks to California’s Consumer Privacy Act (CCPA), which allows residents to request what personal data a company has collected about them, as well as demand its deletion or request to opt out of it being shared or sold. McDonald’s has a dedicated Privacy Rights Center where customers can submit a request to gain access to what the company has collected over the years and how it is using it.

What Rogers found was a trove of papers that included his data, his loyalty points, a list of his past purchases, offers the company has sent him, and more. He reported that the app even kept track of every time he scanned a code as part of McDonald’s annual Monopoly game. It also ranked what products he was most likely to purchase during any given visit.

Most people at this point likely understand the trade-off that comes with a loyalty program: you get deals and discounts, the company gets to collect your data. But it’s a good reminder of just how much information you are giving up and how surveilled our behavior is, even when there’s no camera watching us.

The Washington Post’s Geoffrey Fowler did something similar to Rogers last year, requesting the data Starbucks has on him via the CCPA. What he got was just eight pages, but it revealed that, in the era of surveillance pricing, loyalty programs aren’t the win-win that businesses like to present them as. In fact, he found that the company may have been offering him fewer discounts than other companies because it inferred from the data it had on him that he was more willing to tolerate paying full price.

A report by the Vanderbilt Policy Accelerator and the UC-Berkeley Center for Consumer Law and Economic Justice found that Starbucks is far from alone in this practice. The actual rewards part of so-called rewards programs has started to disappear, but these companies are collecting and selling more data than ever. Fowler found that Starbucks could share his information with 64 other companies, including major data brokers, turning him into a product while offering him fewer benefits on the things that made him a customer in the first place.

That practice has become increasingly common. Last year, a series from Consumer Reports highlighted how grocery store Giant Kroger and delivery app Instacart found that consumers were being charged different prices based on data that the companies had collected on them, leading to some people paying as much as 25% more on some goods being purchased from the same store at the same time.

Maybe we should just go back to good old paper punch cards.

Reporting from Gizmodo contributed to this story.