Vendor drift
Classified material changes to mcdonalds.com’s public trust documents, from continuous monitoring.
Data as of 2026-09-10 — refreshed on a rolling bake, not live. · corporate.mcdonalds.com
Documents are silent on training · verified
as of 2026-08-10
medium · Subprocessor changed · 2026-08-26 · privacy_policy
McDonald's updated its privacy policy to add three new service providers as GDPR controllers/processors: Adyen N.V., Card Compliant, LLC, and Forter, Inc. The policy also expanded scope to cover the McDonald's mobile app for Arch Card balance reloads and usage, and clarified that First Data Resources is now the successor in interest to Gift Solutions LLC.
high · Terms changed · 2026-08-24 · tos
McDonald's substantially restructured its dispute resolution and arbitration provisions (Section 10), replacing the previous AAA-administered arbitration with JAMS administration, introducing a complex multi-stage mass arbitration process with mandatory mediation, and significantly expanding the scope of disputes subject to arbitration while adding new opt-out procedures. The new terms also introduce Arch Card stored-value features with additional terms and conditions, and clarify that guest ordering without an account is now available on McDonald's website.
high · Terms changed · 2025-04-07 · tos
McDonald's replaced its Arch Card-specific Terms and Conditions with comprehensive Terms and Conditions for McDonald's Online Services, significantly expanding the scope to cover MyMcDonald's Rewards, Text Messaging, Delivery, and Mobile Order & Pay programs. The new document introduces mandatory arbitration with AAA (replacing JAMS), class action waivers, expanded liability limitations, and new data collection and communication practices including opt-in email, text, and push notifications tied to the Privacy Statement.
high · Training rights changed · 2026-01-12 · privacy_policy
McDonald's privacy policy now explicitly states it will "train algorithms and AI models that we use in the context of providing you with products and services" using customer personal information. This represents a newly disclosed use of customer data for AI model training, which was not explicitly mentioned in the previous version of the policy.
high · Training rights changed · 2026-07-01 · privacy_policy
McDonald's added explicit language stating it uses customer information "for the training of the algorithms and models of AI that we use to provide you products and services" in Section 2 (How We Use Information We Collect). This represents a newly disclosed AI training right over customer data with no explicit opt-out mechanism mentioned in the visible portions of the policy.
high · Terms changed · 2026-08-24 · tos
McDonald's substantially restructured its dispute resolution and arbitration clause (Section 10), replacing a simpler arbitration process with a complex multi-stage "mass arbitration" procedure that includes mandatory informal resolution, JAMS administration, staged arbitration with mediations, and opt-out windows. The new terms significantly alter how customer disputes are handled and introduce procedural complexity that may affect customers' ability to pursue claims.
Paste your vendor list, confirm your email, and our engine builds your report automatically — which vendors add AI subprocessors or reserve the right to train on your data, and where your nth-party exposure concentrates. Free, delivered during your working day.