Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses automated collection of precise geolocation data, advertising identifiers, UDIDs, device serial numbers, IP addresses, and video recordings of restaurant visits through in-restaurant digital technology.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses a broad range of automated data collection spanning online, mobile, and physical restaurant environments, including persistent device identifiers and in-restaurant video, which collectively enable cross-context tracking of individual customers.
Interpretive note: The provision discloses in-restaurant video collection without specifying whether biometric data is extracted from those recordings; the compliance implications depend on whether biometric processing occurs, which is not addressed in the document.
Under this clause, McDonald's automated collection encompasses geolocation via GPS, Wi-Fi, Bluetooth, and cell tower proximity, advertising identifiers, unique device identifiers, device serial numbers, IP addresses, and video recordings within restaurants. Geolocation collection can be disabled through device or browser settings, and location-dependent features may not function if collection is disabled.
Cross-platform context
See how other platforms handle Collection of Location, Device Identifiers, and In-Restaurant Video and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Our online services and in-restaurant technology may collect information about the location of your mobile device or computer using geolocation and technology such as GPS, Wi-Fi, Bluetooth, or cell tower proximity. For most mobile devices and computer systems, you can disable the collection of this information by using the device or web-browser settings... We may collect information about your: internet protocol (IP) address; computer or mobile-device operating system and browser type; type of mobile device and its settings; unique device identifier (UDID) or mobile equipment identifier (MEID) of your mobile device; device and component serial numbers; advertising identifiers (for example, an Identifier for Advertising (IDFA) on Apple devices) or similar identifiers... visits to our restaurants, where recorded using digital technology (e.g. video recordings)Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR provisions on special categories and sensitive data processing where location data is used to infer sensitive attributes, CCPA categories including geolocation data and unique identifiers, and Illinois BIPA if in-restaurant video technology involves biometric data extraction. The FTC Act engages with respect to adequacy of disclosure for device-level persistent identifier collection. State biometric privacy laws in Illinois, Texas, and Washington may engage if in-restaurant video systems involve facial recognition or biometric identification. 2. GOVERNANCE EXPOSURE: Medium. The collection of in-restaurant video recordings through digital technology is disclosed without specification of whether biometric data is extracted, which may create exposure under state biometric privacy laws if facial recognition or similar technology is employed. The collection of advertising identifiers and UDIDs enables persistent cross-context tracking and may engage California CPRA provisions on sensitive personal information. 3. JURISDICTION FLAGS: Illinois BIPA creates significant exposure if in-restaurant video technology processes biometric identifiers or information without written consent and a compliant retention schedule. Texas and Washington have similar biometric privacy statutes. California CPRA classifies precise geolocation data as sensitive personal information, subject to additional opt-out rights. EU and EEA jurisdictions require a valid GDPR legal basis for location tracking. 4. CONTRACT AND VENDOR IMPLICATIONS: In-restaurant technology vendors providing video or digital tracking systems should be assessed for biometric data processing capabilities and compliance with applicable state biometric privacy laws. Data processing agreements should specify whether biometric data is extracted and what the applicable legal basis and consent mechanism is. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit in-restaurant technology deployments to confirm whether video systems involve biometric data extraction, and if so, ensure compliance with BIPA, Texas CUBI, or Washington My Health MY Data Act as applicable. The disclosure of in-restaurant video collection should be evaluated for sufficiency under GDPR transparency requirements and US state privacy laws.
This provision discloses a broad range of automated data collection spanning online, mobile, and physical restaurant environments, including persistent device identifiers and in-restaurant video, which collectively enable cross-context tracking of individual customers.
Under this clause, McDonald's automated collection encompasses geolocation via GPS, Wi-Fi, Bluetooth, and cell tower proximity, advertising identifiers, unique device identifiers, device serial numbers, IP addresses, and video recordings within restaurants. Geolocation collection can be disabled through device or browser settings, and location-dependent features may not function if collection is disabled.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.