Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy explicitly excludes franchisee-operated restaurants and any digital properties they operate from the scope of this Privacy Statement, directing customers to consult each franchisee's own privacy practices separately.
This analysis describes what McDonald's's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that the privacy protections, rights, and disclosures in this document do not extend to customer interactions with franchisee-operated restaurants or their digital properties, creating a fragmented governance structure across the McDonald's network where customer rights and data practices may vary by location.
Under this clause, customers interacting with a franchisee-operated McDonald's restaurant or a franchisee's website or app are not covered by this Privacy Statement and must separately review the applicable franchisee's privacy practices to understand how their personal information is collected and used.
Cross-platform context
See how other platforms handle Franchisee Privacy Policy Carve-Out and similar clauses.
Compare across platforms →Monitoring
McDonald's has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Many of our restaurants are owned and operated by franchisees, who are independent business owners. This Privacy Statement does not apply to our franchisees or to websites or mobile apps that they operate. Please reference our franchisees' privacy practices for information on how they collect and use customer information.Excerpt from McDonald's's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages the question of data controller identification under GDPR, where a franchisee operating independently may be a separate controller from McDonald's Corporation. Under CCPA, franchisee entities meeting California's business thresholds are independently obligated to comply with state privacy law. The FTC Act may engage this provision if the carve-out creates consumer confusion about applicable privacy protections. 2. GOVERNANCE EXPOSURE: Medium. The carve-out is operationally significant because a substantial portion of McDonald's restaurant locations are franchisee-operated, meaning a large segment of customer interactions may fall outside the scope of this document. The extent of franchisee compliance with applicable privacy laws is not addressed in this document. 3. JURISDICTION FLAGS: EU and EEA jurisdictions create heightened exposure because GDPR requires clear identification of the data controller, and customers may incorrectly assume McDonald's Corporation is the controller for all restaurant interactions. California consumers interacting with franchisees retain independent CCPA rights against those franchisee entities. 4. CONTRACT AND VENDOR IMPLICATIONS: Franchise agreements may or may not impose privacy compliance standards on franchisees consistent with this Privacy Statement. Legal and compliance teams overseeing franchise operations should assess whether franchise agreements include adequate data protection obligations and whether franchisee privacy practices are periodically reviewed. 5. COMPLIANCE CONSIDERATIONS: McDonald's Corporation's compliance team should evaluate whether brand-level consumer communications adequately distinguish franchisee-operated locations from corporate-operated locations in the context of privacy rights. In jurisdictions where regulators may attribute franchisee data practices to the franchisor, additional documentation of the independent controller relationship may be warranted.
This provision establishes that the privacy protections, rights, and disclosures in this document do not extend to customer interactions with franchisee-operated restaurants or their digital properties, creating a fragmented governance structure across the McDonald's network where customer rights and data practices may vary by location.
Under this clause, customers interacting with a franchisee-operated McDonald's restaurant or a franchisee's website or app are not covered by this Privacy Statement and must separately review the applicable franchisee's privacy practices to understand how their personal information is collected and used.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by McDonald's.