Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The US addendum provides a CCPA-required financial incentive notice disclosing that participation in MyMcDonald's Rewards involves collection of identifiers, payment details, purchase records, app interaction data, geolocation, and behavioral inferences, with McDonald's stating it does not assign an independent monetary value to this data.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the data collection scope for the loyalty program and satisfies the California law requirement to disclose the material terms of financial incentive programs that involve personal information, including the categories of data collected and an estimate of its value relative to program benefits.
Under this clause, enrollment in MyMcDonald's Rewards is conditioned on opt-in consent and authorizes collection of identifiers, payment information, purchase records, geolocation, app interaction data, and behavioral inferences. The agreement states consumers may withdraw from the program at any time through profile settings in the McDonald's app.
Cross-platform context
See how other platforms handle MyMcDonald's Rewards Financial Incentive Notice and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"McDonald's collects personal information in connection with providing the MyMcDonald's Rewards program to consumers. This includes the following categories of personal information: Identifiers, such as participants' name, email address, (optional) day and month of birth, and MyMcDonald's Rewards account numbers; Personal information described in Cal. Civil Code § 1798.80(e), such as phone number and payment information (such as payment card details); Commercial information, such as records of members' purchases, information about actions taken while using the McDonald's app, and members' rewards account credentials; Internet or other electronic network information reflecting a participants' interaction with the McDonald's app, in-restaurant technologies, or ads in connection with the MyMcDonald's Rewards program; Geolocation data, which may be collected if participants enable their devices to collect their location (and which can be disabled at any time in device settings); and Inferences drawn from any of the above categories of information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages the CCPA and CPRA, which require businesses to provide a notice of financial incentive before enrolling consumers in programs that involve the collection or use of personal information in exchange for a financial benefit. The provision cites Cal. Civil Code Section 1798.80(e) directly. The California Privacy Protection Agency has enforcement authority. The FTC Act may also engage this provision with respect to adequacy of material disclosure. 2. GOVERNANCE EXPOSURE: Medium. The notice includes the required categories of personal information and a good-faith valuation statement, but McDonald's declines to assign a specific monetary value to the personal information collected, instead asserting that program value to consumers exceeds data value. This approach is consistent with CPRA guidance but may attract regulatory scrutiny if the valuation methodology is not adequately documented. 3. JURISDICTION FLAGS: California creates the primary compliance exposure due to CPRA financial incentive notice requirements. Other US states with loyalty program or financial incentive disclosure requirements may also engage this provision. The sharing of inferences and identifiers with advertising partners in connection with the program may separately trigger opt-out obligations in multiple states. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party reward redemption partners, payment processors, and advertising partners who receive data in connection with MyMcDonald's Rewards should be assessed for compliance with data use limitations stated in this notice. The disclosure that certain sharing may constitute a sale under state law applies to Rewards program data as well as general customer data. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that opt-in consent for MyMcDonald's Rewards is obtained through a compliant mechanism, that the valuation methodology referenced in the notice is documented, and that withdrawal from the program results in cessation of data processing for Rewards-specific purposes within required timeframes.
This provision establishes the data collection scope for the loyalty program and satisfies the California law requirement to disclose the material terms of financial incentive programs that involve personal information, including the categories of data collected and an estimate of its value relative to program benefits.
Under this clause, enrollment in MyMcDonald's Rewards is conditioned on opt-in consent and authorizes collection of identifiers, payment information, purchase records, geolocation, app interaction data, and behavioral inferences. The agreement states consumers may withdraw from the program at any time through profile settings in the McDonald's app.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.