WHAT THE POLICIES SAY

McDonald's Corporation is a publicly traded (NYSE: MCD) Delaware corporation and the world's largest fast-food chain, operating the McDonald's app and MyMcDonald's Rewards loyalty program. Its App Store privacy label discloses collecting precise location and purchase history linked to identity, and separately discloses Contact Info and Identifiers used to track users across apps and websites owned by other companies. McDonald's own privacy materials disclose partnering with 'select advertising partners' for targeted advertising and operate a CCPA/CPRA 'Do Not Sell or Share My Personal Information' request type, implying such sharing occurs absent an opt-out. Ownership is fully traceable through mandatory SEC 10-K filings. No enforcement action was found, but in June-July 2025 independent security researchers found and privately disclosed that McDonald's AI hiring platform McHire (built by vendor Paradox.ai) was protected by a default admin password and an API flaw that together could have exposed the personal data and chat transcripts of tens of millions of job applicants; McDonald's and Paradox.ai fixed the flaw within about a day of disclosure.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

5 ON FILE

COLLECTION

Apple's App Store privacy label for the McDonald's app discloses that Location (Precise Location, Coarse Location) and Purchase History are among the categories of 'Data Linked to You' -- collected and linked to the user's identity -- alongside Contact Info, Identifiers, Search History and Browsing History.

apps.apple.com ↗

[2026-02-24] · OWNERSHIP TRANSPARENCY

McDonald's Corporation's SEC Form 10-K cover page identifies it as a Delaware corporation with a listed IRS Employer Identification Number, filed as part of its mandatory annual regulatory disclosures.

sec.gov ↗

SHARING

McDonald's CCPA/CPRA privacy-rights web form (hosted on its OneTrust privacy portal, linked from its Privacy Statement) offers a 'Do Not Sell or Share My Personal Information' request type, whose tooltip states that once exercised, McDonald's 'may not sell or share my personal information with third parties for valuable consideration or targeted advertising' -- confirming such sharing is the default absent this opt-out.

privacyportal-mcdonalds.my.onetrust.com ↗

[2025-07-09] · TRACK RECORD

Independent security researchers' own disclosure writeup documents that McDonald's AI hiring platform McHire, built by vendor Paradox.ai, accepted default administrator credentials '123456:123456' and had an insecure direct object reference (IDOR) flaw on an internal API that together allowed retrieval of the personal data of more than 64 million job applicants, including chat transcripts; the same writeup records that McDonald's confirmed receipt of the report within roughly 38 minutes and that the exploitable credentials were disabled within under two hours, with Paradox.ai confirming full remediation the next day -- a real, non-trivial exposure caught and fixed fast, but only because outside researchers found it, not McDonald's own monitoring.

ian.sh ↗

TRACKING TECH

Apple's App Store privacy label for the McDonald's app discloses that Contact Info and Identifiers may be used to track users across apps and websites owned by other companies.

apps.apple.com ↗

LAST REVIEWED 2026-08-19 · METHODOLOGY v1.7