MCD · 10-Q · 2026Q3 · Full report

Privacy and Data Regulation

MCDONALDS CORP · 2026-11-06 · Importance 32 · Surprise 24

McDonald’s identifies the European Union’s General Data Protection Regulation and various U.S. state-level privacy laws as requirements applicable to its business, with further requirements anticipated. It also cites the EU AI Act and U.S. state-level regulations as relevant to expanding digital engagement, data collection, and AI personalization. The filing warns that non-compliance or misuse of personal data could lead to fines, litigation, and reputational harm, but gives no amounts or implementation timeframe.

Key facts

• As McDonald’s expands digital engagement, data collection and AI personalization, it faces heightened risks under U.S. state regulations and the EU AI Act; non-compliance or personal-data misuse could lead to significant fines, litigation and reputational harm. source
• Cybersecurity incidents could cause McDonald’s mitigation costs, reputational damage, adverse publicity, reduced sales and profits, and regulatory or legal risks including fines, penalties or civil liabilities. source
• McDonald’s faces increasing worldwide regulation involving restaurant operations, packaging and extended producer responsibility, marketing, information technology, nutrition and allergen content, food safety, labeling and disclosure practices; compliance may increase costs and litigation or investigation exposure. source
• McDonald’s is subject to privacy and data-protection requirements including the EU GDPR and U.S. state laws; failure to comply could lead to substantial fines, penalties or liabilities and materially adversely affect financial results or brand perceptions. source