Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The global section states McDonald's does not sell personal information for monetary consideration, while acknowledging that US state law definitions of 'sale' may encompass sharing with advertising networks and analytics companies for valuable consideration, directing US users to the country-specific addendum.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses a structurally significant tension between the policy's assertion of no monetary sale and the acknowledgment that sharing arrangements with advertising and analytics partners may qualify as sales under California and other US state privacy statutes, triggering opt-out rights and disclosure obligations under those frameworks.
Under this clause, McDonald's discloses that sharing identifiers, pseudonymized identifiers, and behavioral inferences with social media, advertising, and analytics partners may constitute a sale of personal information under certain state laws. The US addendum states that consumers may opt out of this sharing through applicable opt-out mechanisms including the Global Privacy Control signal.
Cross-platform context
See how other platforms handle Data Sharing as Potential Sale Under State Law and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We do not sell your personal information for monetary consideration and only share your information as described in this Privacy Statement or as otherwise communicated to you at the time we collect your information. Please note that some US state statutes may define a "sale" to include sharing of personal information with third parties for valuable consideration. Many companies have common arrangements with online advertising networks and analytics companies that may be considered sales under these definitions. Please reference our US Country Specific Addendum (below) for more information.Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly implicates the California Consumer Privacy Act (CCPA) and its amendment by the California Privacy Rights Act (CPRA), which define sale broadly to include sharing for valuable consideration including non-monetary consideration. Colorado, Connecticut, Virginia, and other US state privacy statutes with similar definitions are also engaged. The California Privacy Protection Agency and California Attorney General have enforcement authority. The FTC Act engages this provision with respect to whether the disclosure is adequate to satisfy consumer protection standards. 2. GOVERNANCE EXPOSURE: High. The explicit acknowledgment that advertising network and analytics sharing arrangements may qualify as sales under state law definitions requires ongoing opt-out infrastructure, GPC signal processing, and data sale disclosure compliance across all US-facing digital properties. Failure to honor opt-out requests or GPC signals as required by California law carries enforcement risk from the California Privacy Protection Agency. 3. JURISDICTION FLAGS: California creates the highest exposure given CPRA enforcement authority and specific requirements for opt-out of sale and sharing. Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws create additional compliance obligations. Illinois, New York, and Washington may also engage depending on data categories shared. 4. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising networks, social media platforms, and analytics vendors should be reviewed to determine whether they qualify as sale or sharing arrangements under applicable state definitions, and whether downstream use limitations and contractual obligations consistent with opt-out requests are in place. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that GPC signal detection and processing is operationally implemented across all US digital properties, that opt-out requests are honored within legally required timeframes, and that the data sale and sharing disclosure in the US addendum is updated to reflect all current advertising and analytics partner relationships.
This provision discloses a structurally significant tension between the policy's assertion of no monetary sale and the acknowledgment that sharing arrangements with advertising and analytics partners may qualify as sales under California and other US state privacy statutes, triggering opt-out rights and disclosure obligations under those frameworks.
Under this clause, McDonald's discloses that sharing identifiers, pseudonymized identifiers, and behavioral inferences with social media, advertising, and analytics partners may constitute a sale of personal information under certain state laws. The US addendum states that consumers may opt out of this sharing through applicable opt-out mechanisms including the Global Privacy Control signal.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.