Why is data protection an issue & what would be a violation? If I walk into one of their establishments & order a burger, the store has zero idea who I am. I just pay, get an order ID & stand there and wait. I don't have to login. There's no PII.
They're aggressively herding people into the behavior of ordering through an app, to the point (people have told me) of charging higher prices if you walk in and pay.
I don't know how common it is nationwide, but around here, McDonald's and most Chipotles won't take orders at the register. McDonalds will direct you to the kiosk and at Chipotle, if you don't have a phone or tablet to order online, then you're SOL.
Many retail chains I've gone to have the capability to look up your entire purchase history via a credit card, or to refund a purchase to the card that was used.
I don't know if they store the card details directly or if they store a hash, but they certainly have a way to tie your credit card to the video of your face leaving the store and (most likely) a video of your license plate as you drive away.
Sell that to a data broker (as they certainly do in the US) and someone could potentially purchase a history of what you bought anywhere and when.
I've had that experience too. I assume they use your card details to find your internal customer identifier or something and then discard the card details.
It's stored by your bank but your credit card or account id is never transferred to the retailer by the payment processors instead what happens is that McDonalds get an unique transaction ID that only your card provider knows was generated by your card.
McDonald's don't your bank does know you authorized an transaction using pin/card/app.
The payment terminal is essentially not actually talking directly to the POS except to tell it that transaction id "xyz"(which only your bank/"card issuer" know is you) was approved, everything else is encrypted between terminal and payment processor and not supposed to be visible to the retailer.
Comments
Why is data protection an issue & what would be a violation? If I walk into one of their establishments & order a burger, the store has zero idea who I am. I just pay, get an order ID & stand there and wait. I don't have to login. There's no PII.
They're aggressively herding people into the behavior of ordering through an app, to the point (people have told me) of charging higher prices if you walk in and pay.
I don't know how common it is nationwide, but around here, McDonald's and most Chipotles won't take orders at the register. McDonalds will direct you to the kiosk and at Chipotle, if you don't have a phone or tablet to order online, then you're SOL.
Been like that ever since COVID lockdown.
Kiosks I don't mind, you can still order anonymously. I just won't use an app or web site I have to maintain an account on.
I keep expecting them to remove the 20% discount, but it's available every time.
You don't have to, but you may: ordering via app, collecting loyalty points as well as PII of the staff.
There appeared to be different apps for different countries last I looked in the App Store
What does that tell about the backend system? - Nothing.
Also last time I went to auch a place they asked me for a loyalty thingy even when not ordering by app.
Did you pay cash?
What's that got to do with anything? Card details aren't stored.
Many retail chains I've gone to have the capability to look up your entire purchase history via a credit card, or to refund a purchase to the card that was used.
I don't know if they store the card details directly or if they store a hash, but they certainly have a way to tie your credit card to the video of your face leaving the store and (most likely) a video of your license plate as you drive away.
Sell that to a data broker (as they certainly do in the US) and someone could potentially purchase a history of what you bought anywhere and when.
I've had that experience too. I assume they use your card details to find your internal customer identifier or something and then discard the card details.
Don't they have to maintain that mapping to keep it available?
Is there no trace of you sending money from your card to McDonalds ? How do they audit for fraud ?
It's stored by your bank but your credit card or account id is never transferred to the retailer by the payment processors instead what happens is that McDonalds get an unique transaction ID that only your card provider knows was generated by your card.
So how do they know it was me who sent the money and not some McDonalds money launderer ?
McDonald's don't your bank does know you authorized an transaction using pin/card/app.
The payment terminal is essentially not actually talking directly to the POS except to tell it that transaction id "xyz"(which only your bank/"card issuer" know is you) was approved, everything else is encrypted between terminal and payment processor and not supposed to be visible to the retailer.
Yours arent, but other people's are when they agree.