A McDonald’s 515-page data file obtained by a WIRED reporter offers an unusually concrete look at the records a fast-food loyalty account can produce. The reporter, who said they are a California resident, requested their information through McDonald’s privacy process and received the document a few days later, WIRED reported.
The file was not just a purchase list. According to WIRED, it included forecasts for that one customer’s next six weeks: 2.16 expected visits, an estimated $13.49 per order and $29.15 in projected total spending. It also assigned an attrition likelihood of zero. That score does not establish that McDonald’s knows the customer will keep returning. WIRED said the company did not supply a definition, and described the figure as potentially indicating that the reporter was considered unlikely to stop being a customer.
WIRED reported other opaque labels in the record, including the internal customer-group code “CV2,” whose meaning McDonald’s did not explain. The file reportedly named a large Diet Coke as the reporter’s highest-ranked product by a recency, frequency and monetary measure, and listed “Food-Led Afternoon Snack” and “On the Go Lunch in a Rush” as recurring purchase occasions. It identified San Francisco and Santa Barbara as the most visited locations, with 61 visits.
What did the McDonald’s data file include?
Much of the 515-page document consisted of historical account activity, WIRED reported: transactions, promotions sent to the reporter, loyalty-point totals and app-linked details about when, where and what they bought. The record also included scans tied to McDonald’s Monopoly promotion and the prizes received.
Those reported fields should be read as one person’s disclosure, not a public map of every McDonald’s customer profile. The underlying document is not available here, and neither the reported record nor McDonald’s published privacy policy explains the model behind the forecasts or the CV2 label.
McDonald’s told WIRED it uses information including prior purchases to make the customer experience more personal, citing relevant deals, offers and messages. The company said customers have privacy choices described in its privacy statement.
Its U.S. privacy statement, updated July 1, 2026, says the company may collect details customers supply, transaction and account information, and profile data such as products they like or preferred visit times. It also says automated collection can cover device and advertising identifiers, browsing or app activity, and digitally recorded restaurant visits. Location may be collected through GPS, Wi-Fi, Bluetooth or cell-tower proximity, depending on how customers use its services. McDonald’s says location collection can generally be disabled through device or browser settings.
Jeff Chester, executive director of the Center for Digital Democracy, told WIRED that commercial surveillance is central to McDonald’s approach. Privacy experts who spoke with WIRED said the degree of detail may feel intrusive but is common among large American loyalty programs. The reported file shows the practical result: a customer’s purchases can become both a history and a set of estimates, even where the company has not disclosed the math.
This story draws on original reporting from WIRED.
