California residents have specific legal rights over their McDonald's data, including the right to see, delete, correct, and stop the sale or sharing of their personal information.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These rights give California consumers meaningful control over how their data is used, including the ability to stop it from being shared with advertising partners and to have it deleted entirely.
If you live in California, you can request that McDonald's delete your personal information, correct inaccuracies, or stop sharing it with advertising partners, and McDonald's is legally required to respond to these requests within specified timeframes under CPRA.
How other platforms handle this
If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA) and related regulations, including the right to know what personal information we collect and how it is used, the right to request deletion of your personal information, the right to opt out of...
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
California law gives residents the right to know what personal information we collect, use, share or sell; to delete personal information under certain circumstances; to opt-out of the sale or sharing of their personal information; to correct inaccurate personal information; to limit the use and dis...
Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell about you; the right to delete personal information we have collected from you; the right to correct inaccurate personal information; the right to opt-out of the sale or sharing of your personal information; and the right to limit the use and disclosure of your sensitive personal information.— Excerpt from McDonald's's McDonald's Privacy Policy
REGULATORY LANDSCAPE: This provision directly implements rights established under the California Consumer Privacy Act as amended by the California Privacy Rights Act. Enforcement authority rests with the California Privacy Protection Agency and the California Attorney General. The rights enumerated, including access, deletion, correction, opt-out of sale and sharing, and sensitive data limitation, are statutory obligations rather than discretionary disclosures. GOVERNANCE EXPOSURE: High. McDonald's serves a large California consumer base through its app and loyalty program, creating material exposure to individual rights requests at scale. Operationalizing the correction and sensitive data limitation rights added by CPRA may require systems and process updates beyond those required under original CCPA. JURISDICTION FLAGS: These rights apply exclusively to California residents. However, compliance teams should note that similar rights frameworks are emerging in Virginia, Colorado, Connecticut, Texas, and other states, and a California-compliant process may inform but not fully satisfy obligations in those jurisdictions. CONTRACT AND VENDOR IMPLICATIONS: Service providers and advertising partners who receive McDonald's consumer data must be contractually prohibited from processing that data in ways inconsistent with consumer opt-out requests. Data processing agreements should include provisions for honoring deletion and opt-out requests passed through from McDonald's. COMPLIANCE CONSIDERATIONS: Legal teams should verify that the consumer rights request portal is functional, that response timelines comply with CPRA's 45-day response requirement, that identity verification procedures are not unduly burdensome, and that opt-out requests are propagated to downstream data recipients including advertising partners.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
These rights give California consumers meaningful control over how their data is used, including the ability to stop it from being shared with advertising partners and to have it deleted entirely.
If you live in California, you can request that McDonald's delete your personal information, correct inaccuracies, or stop sharing it with advertising partners, and McDonald's is legally required to respond to these requests within specified timeframes under CPRA.
ConductAtlas has identified this type of provision across 11 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.