Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that McDonald's uses customer personal information to train algorithms and AI models, and employs profiling technology, with a stated carve-out that such profiling will not include automated decisions with legal or similarly significant effects unless separately disclosed.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a broad authorization to use customer data for AI and algorithm training across McDonald's products and services, with the carve-out for automated individual decisions referencing GDPR Article 22 language but not specifying which data categories are used in training or whether third-party AI vendors are involved in this processing.
Interpretive note: The scope of data categories used in AI training and the conditions triggering the separate notification for automated decisions are not specified in the document, creating ambiguity about the operational boundaries of this provision.
Under this clause, personal information customers provide or generate through app use, restaurant visits, and online interactions may be used to train McDonald's AI models. The agreement states that profiling under this provision will not include automated decisions with legal or similarly significant effects for the individual unless separately communicated.
Cross-platform context
See how other platforms handle AI Model Training Using Customer Data and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"to train algorithms and AI models that we use in the context of providing you with products and services; to personalize and improve our products and services and your overall customer experience, in particular by improving our existing technologies and developing new products and services and employing profiling technology (unless we notify you separately thereof, this will not include automated individual decisions that have legal effects for you or similarly significantly affect you)Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR Article 22 (automated individual decision-making and profiling), which the document acknowledges by explicitly carving out decisions with legal or similarly significant effects. The EU AI Act may also engage this provision depending on the classification of AI systems McDonald's deploys. The FTC Act engages this provision with respect to US consumers if AI training involves data uses materially inconsistent with the context in which it was collected. Relevant enforcement authorities include EU data protection authorities and the FTC. 2. GOVERNANCE EXPOSURE: Medium. The provision broadly authorizes AI training using customer data but does not specify data categories used in training, model types, or third-party AI processor involvement. The GDPR-aligned carve-out for automated decisions with significant effects is present but relies on a future separate notification mechanism whose trigger conditions are not defined in this document. 3. JURISDICTION FLAGS: EU and EEA jurisdictions create heightened exposure given GDPR Article 22 obligations and the emerging EU AI Act framework. California's CCPA and its regulations on profiling and automated decision-making may also apply to US consumers. The document's reliance on legitimate interests as a GDPR legal basis for personalization and profiling (Article 6(1)(f)) may face challenge in jurisdictions where data protection authorities apply a strict balancing test. 4. CONTRACT AND VENDOR IMPLICATIONS: The provision does not identify whether third-party AI vendors process customer data as processors or independent controllers for training purposes. Procurement and vendor management teams should assess data processing agreements with AI vendors to confirm appropriate controller-processor relationships and data use limitations consistent with this disclosure. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether the AI training disclosure is sufficiently specific to satisfy GDPR transparency obligations under Articles 13 and 14, and whether a Data Protection Impact Assessment has been conducted for AI training use cases. The trigger conditions for the separate notification referenced in the carve-out should be documented and operationalized.
This provision establishes a broad authorization to use customer data for AI and algorithm training across McDonald's products and services, with the carve-out for automated individual decisions referencing GDPR Article 22 language but not specifying which data categories are used in training or whether third-party AI vendors are involved in this processing.
Under this clause, personal information customers provide or generate through app use, restaurant visits, and online interactions may be used to train McDonald's AI models. The agreement states that profiling under this provision will not include automated decisions with legal or similarly significant effects for the individual unless separately communicated.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.