Mehrotra's GDPR/CCPA request surfaced a 515-page dossier covering every app order since 2019, location pings, ad IDs, notification engagement, and a churn-risk score. His framing is that the specifics are mundane engineering — the story is that a burger chain now runs the same event-capture, warehouse, and propensity-modeling stack as any modern growth team.
Argues the dossier is unremarkable in its components — Segment/Rudderstack pipes, Snowflake/BigQuery warehouses, Braze/Iterable messaging, a Python propensity model — and that any engineer who has worked on a growth team since 2020 has built some fraction of it. The significance is normalization: surveillance loyalty is now the default consumer-app architecture.
Highlights that Mehrotra's coupons were priced against his modeled price sensitivity — because the model classified him as high-value/low-churn-risk, he received worse deals than churn-risk customers in the same line. He frames this as the concrete harm that moves the story from creepy-data-collection to discriminatory pricing.
Singles out the differential-coupon detail as the one that will end up in a legislative hearing. The argument is that indefinite location retention and rolling propensity scores are abstract concerns, but a customer being charged more because a model predicted they wouldn't leave is a concrete, legible harm.
Notes McDonald's retains location data essentially indefinitely and regenerates the propensity score on a rolling basis rather than storing snapshots. Together these choices mean there is no audit trail of what the model believed about a customer at any past moment, and no natural expiration of the underlying signal.
Wired's Dhruv Mehrotra filed a data-subject access request against McDonald's under GDPR and the California CCPA. What came back was a 515-page PDF: every mobile-app order since 2019, the store he placed it at, the payment token used, the push notifications he opened, the ones he ignored, the coupons he redeemed, the coupons he almost redeemed, the lat/long his phone reported when the app was open, the device model, the OS version, the ad IDs, and — the part that made the story — a machine-learned score labeling him a "high-value, low-churn-risk" customer. Translated: the model thinks he will never stop eating there.
The dossier isn't interesting because McDonald's is uniquely creepy; it's interesting because McDonald's is uniquely ordinary. The company is a burger chain with a mobile app, a loyalty program, and a data team. The stack Wired describes — SDK-level event capture, a cloud warehouse, a churn/propensity model, a marketing-automation layer that fires push notifications and coupon drops — is the same stack shipped by roughly every consumer-facing product built in the last five years. Braze or Iterable for messaging. Segment or Rudderstack for event pipes. Snowflake or BigQuery for the warehouse. A dbt project. A propensity model in Python that a data scientist ships to a feature store. If you have worked on a growth team since 2020, you have built some fraction of this.
The piece names a few specifics worth noting: McDonald's retains the location data essentially indefinitely, the propensity score is regenerated on a rolling basis rather than snapshotted, and the coupons offered to Mehrotra were priced against his predicted price sensitivity — he was getting worse deals than churn-risk customers sitting next to him in line. That last detail is the one that will end up in a legislative hearing.
Every time one of these stories lands, engineers roll their eyes at the coverage — of course the app collects events, that's what apps do — and then move on. That reaction is the problem. The gap between what a working engineer considers routine instrumentation and what a regulator, a jury, or a customer considers a dossier is now measured in a single PDF export. The events themselves are boring. Concatenated, timestamped, geocoded, and scored, they become a document that reads like surveillance because it functionally is.
The technical debate here isn't whether to collect the data. That ship sailed around 2016. The debate is about retention, minimization, and derivation. Retention: your event stream from 2019 does not need to be queryable in 2026 at row-level fidelity. Roll it up. Minimization: you probably do not need lat/long to six decimal places when the store ID is right there in the same event. Derivation: the churn-risk score is the single most legally radioactive artifact in the file, because it is the company forming and storing an *opinion* about the customer, and opinions attached to identifiers are what GDPR Article 22 ("automated decision-making") was written to constrain.
Community reaction on the HN thread split predictably. One camp: this is a nothingburger, opt in to a loyalty program and you get loyalty-program data collection, film at 11. The other camp: the price discrimination angle is not a nothingburger, and "you agreed to the terms" stops being a defense the moment the model starts charging different humans different prices for the same Big Mac based on inferred willingness to pay. The strongest version of the critical argument isn't about privacy at all — it's that personalization has quietly become a mechanism for algorithmic price discrimination that would be illegal if a cashier did it manually.
Compare this to the airline-pricing playbook, which is the honest precedent. Airlines have priced by segment for forty years and everyone hates it and no one has stopped them. The McDonald's file is what happens when that playbook fuses with a mobile-first loyalty program and a cloud data stack cheap enough that a QSR chain can run it on every one of 150 million app users. The economics that used to require a Sabre terminal now require a dbt model and a Braze seat.
A quieter point the Wired piece surfaces: the file was produced *because* McDonald's has a reasonably mature data-subject-request pipeline. Most companies do not. If you filed the same request against a mid-size DTC brand you would get either nothing, a broken CSV, or a legal letter. The maturity of the export is itself evidence that the underlying warehouse is well-organized, well-joined, and queryable by customer ID — which is the same property that makes the dossier possible.
If you ship anything with a login and a push notification, take the McDonald's file as a preview of your own next DSAR. A few concrete moves:
Audit your event schema for fields you cannot justify at row-level retention. Precise geolocation is the classic offender. If your product decision is "which store did they visit," store the store ID, not the coordinates. If you need coordinates for a heatmap, aggregate nightly and drop the raw. The rule of thumb: if a subject-access request would embarrass you when the field is printed on page 312, don't keep the field.
Treat derived scores as first-class PII. Your churn model output, your LTV bucket, your "VIP tier" flag — all of these are attached to an identifiable person and all of them show up in a DSAR export. Version them. Document how they're computed. Be ready to explain, in plain English to a regulator, what "segment_h3" means. GDPR Article 22 and the California ADMT rules that took effect this year both require it, and the enforcement posture on both is now real, not theoretical.
Separate personalization from price. Offering a returning customer a better UX is defensible. Offering them a worse coupon than the person next to them because your model thinks they'll pay anyway is the kind of thing that ends up in a class action. The technical fix is to route pricing decisions through a separate, auditable service that logs its inputs and outputs, rather than letting the marketing-automation platform silently A/B-test price sensitivity as a growth lever. Your legal team will thank you later; your growth team will not thank you now.
Build the DSAR export before you're forced to. The teams that get burned are the ones that discover, during a live regulatory request, that their customer data is scattered across seven warehouses, three vendors, and a legacy Postgres nobody remembers owning. If you can't produce a subject's file in under 30 days today, you already have a problem; you just haven't been asked yet.
The interesting question isn't whether the McDonald's file is legal — mostly it is, for now, in most jurisdictions. The question is how long "mostly legal" survives contact with a public that has now seen what 515 pages of themselves looks like. Colorado, Texas, and the EU's upcoming AI Act enforcement all point in the same direction: derived scores about individuals are moving from "internal analytics artifact" to "regulated output," and the compliance surface area of every growth stack is about to expand accordingly. The engineers who quietly refactor for minimization and retention this year will look prescient. The ones who wait for the subpoena will be reading their own dossiers in a deposition.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.