The Secret Behind Your Big Mac: McDonald's 'Supersize McDossier' on You

Ever grab a quick meal at McDonald's, maybe through their app, and think nothing of it? Well, you might be surprised just how much Big Brother—or rather, Big Mac—is watching. It turns out that underneath the golden arches, there’s a sophisticated data-gathering operation at play, quietly building incredibly detailed profiles on its most loyal customers.

Just recently, a Wired reporter named Reece Rogers got a firsthand, and frankly, startling look at this. Thanks to his rights as a California resident under the California Consumer Privacy Act (CCPA), he requested his personal data file from McDonald's. What he received back wasn't just a few pages; it was a staggering 515-page 'Supersize McDossier,' as he aptly called it.

Think about that for a second: 515 pages. What exactly filled those digital binders, you ask? Everything, it seems. Rogers' file meticulously logged every past order, his accumulated loyalty points, even the Monopoly sweepstakes codes he'd entered. Beyond that, it tracked every single offer McDonald's had ever sent his way. Every time he so much as opened the app, a new entry was created, detailing precisely when, where, and what he purchased. It’s almost like a digital shadow, silently following your every fast-food craving.

But it doesn’t stop at just recording history. McDonald's, like many modern companies, employs sophisticated predictive algorithms. These aren't just for showing you ads; they're designed to forecast your future behavior. For Rogers, this meant predictions about how often he was likely to visit—like 2.16 times over six weeks—his average spend, his total projected spend, and even his 'attrition likelihood.' The system deemed him 0% likely to stop being a customer. It also categorized his behavior, labelling him, for instance, as a 'Food-Led Afternoon Snack' kind of guy or someone who prefers an 'On the Go Lunch in a Rush.' It’s a level of personal insight that feels, well, a little too personal for a fast-food chain.

Now, McDonald's, of course, states that all this data collection is aimed at providing a 'more engaging, personal customer experience,' tailoring deals and offers specifically for you. And honestly, it makes sense from a business perspective; earlier this year, their CFO highlighted the loyalty program’s 210 million active users as their 'single most important digital metric.' Yet, for privacy advocates, this aggressive data strategy crosses a line. Jeff Chester, who serves as the Executive Director for the Center for Digital Democracy—a non-profit organization focused on digital privacy and consumer protections—put it bluntly to Wired: 'McDonald's secret sauce is really commercial surveillance.'

And while this customer surveillance is certainly eye-opening, it’s not the only time McDonald's has faced scrutiny over its handling of personal information. Just a year prior to the 'McDossier' revelations, the company experienced a significant data leak that affected millions of hopeful job applicants.

This particular incident, identified in June 2025, involved McDonald's McHire recruitment platform, which utilizes an AI chatbot named Olivia, developed by Paradox.ai. The breach was substantial, exposing the personal details of up to 64 million job applicants. We’re talking full names, email addresses, phone numbers, home addresses, even their chat logs with the AI assistant, and preferred shift times. Crucially, authentication tokens were also left vulnerable, adding another layer of risk.

The cause? A pretty basic, yet glaring, set of security vulnerabilities. Researchers Ian Carroll and Sam Curry uncovered issues like a test administrative account belonging to Paradox.ai that sported the embarrassingly simple username and password combo of '123456.' Imagine that! There was also a stark absence of multi-factor authentication, and an Insecure Direct Object Reference (IDOR) vulnerability that allowed access to other applicant records just by tweaking ID numbers. What’s even more astounding is that this vulnerable test account had been dormant since 2019 but was never decommissioned. Once reported, Paradox.ai quickly disabled the account and patched the vulnerability, even launching a bug bounty program. McDonald's, for its part, pointed fingers at its vendor, Paradox.ai, as is often the case in such situations.

So, the next time you order a Big Mac or apply for a job under the golden arches, it’s worth pausing to consider the sheer volume of data being collected. From predicting your next craving to storing your personal details, McDonald's, like many corporations today, operates on a massive scale of information. It leaves us to wonder, in an increasingly digital world, just how much of our privacy we're willing to trade for convenience.