I asked 100 companies for my data. Some deleted it instead.

A consumer used California Consumer Privacy Act (CCPA) rights to request access to McDonald’s personal data collection and received a 515-page report detailing app interactions and making predictions about future behavior. The article notes CCPA provisions covering opt-out of selling, deletion, and requesting copies of personal data, with the author submitting 100+ additional requests to compare what others may have on them.

Analysis

This is more of a governance/brand-risk datapoint than a fundamental earnings event. For MCD, the real exposure is not one privacy request but the possibility that a meaningful share of app users opt out of personalization, which would reduce the efficiency of digital coupons, offer targeting, and retention spend over the next 6-18 months. That said, McDonald’s core demand is habit-driven; privacy scrutiny is unlikely to move traffic materially unless it coincides with an actual breach or a headline-grabbing enforcement action.

The second-order read-through is broader for QSR and consumer apps that use first-party data as a margin lever. If regulators or media keep spotlighting how much behavioral data these platforms retain, peers with heavier loyalty economics — notably SBUX, CMG, and DPZ — could face a higher compliance burden and softer conversion on personalized marketing. Conversely, companies with simpler customer interfaces and less reliance on behavioral monetization should be relatively insulated.

The contrarian view is that the market may be overestimating the economic value of this data to MCD and underestimating how defensive its brand can be. Unless we see a measurable decline in app MAUs, loyalty redemption rates, or a disclosure of rising privacy compliance costs in the next 1-2 quarters, this likely stays a non-event for the stock. The cleanest falsifier is any evidence that digital sales growth decelerates or opt-out rates rise enough to pressure CRM efficiency.

Key Decisions for Investors

• No immediate MCD trade: treat this as a monitoring item unless the next earnings call shows weaker app engagement or higher promo inefficiency; the expected impact is too small for a standalone position.
• Watch MCD, SBUX, CMG, and DPZ for any disclosure of consent/opt-out metrics or higher digital marketing spend over the next 1-2 quarters; a deterioration would justify a relative short in the more app-dependent name.
• If privacy headlines broaden into enforcement or litigation, consider a short-term hedge via long VCR / short XLY rather than a single-name short, since the sector impact would be more about compliance sentiment than fundamentals.
• Set an alert for any commentary on loyalty active users or digital mix in the next earnings cycle; if those metrics remain stable, the privacy overhang is likely noise and any dip in MCD should be faded.