How two viral stories about “creepy” loyalty data left out the part where the customer got something in return

Twice in the last year, a journalist has asked a beloved consumer brand for a copy of their own loyalty data and twice, the resulting story has gone viral for the same reason: the file was enormous.

In October 2025, the Washington Post’s Geoffrey Fowler requested his Starbucks Rewards data and received an eight-page report showing, among other things, that his discounts thinned out the more coffee he bought.

In August 2026, Wired’s Reece Rogers asked McDonald’s for his loyalty data and got back 515 pages that included his transaction history, Monopoly game codes, and an algorithmic prediction that he had a zero percent chance of ever stopping being a customer. Rogers compared his data file to an FBI dossier, stating that he intended to stop eating there, “partly to prove the algorithm wrong.”

Both stories are legitimate journalism about a legitimate issue: brands collect more data than most consumers realize, and the format in which that data is disclosed back to them is often unreadable.

But both stories also share a framing problem: while each reporter registered shock over the volume and nature of the data collected, neither meaningfully addressed the fact that he chose to join the program (presumably because he liked the brand), used it repeatedly, and received real value from it.

The Bargain That Went Unmentioned

Rogers noted, in passing, that he signed up “mainly to get food deals.” That’s the entire extent of the acknowledgment. The author did not include any context to inform readers whether McDonald’s was his favorite fast-food brand and that he loved the French fries, or if he did all of this just to learn about what McDonald’s was collecting and learning about him.

That context would help to inform the nature and intent of his 1,500-word article treating his discovery as a privacy intrusion rather than what it is closer to: the visible paper trail of a transaction he initiated and repeated for years. One that got him free food, Monopoly prizes, and personalized offers he found worth opening an app for.

Fowler took a similar approach and omitted the context that would have helped to fully understand the impact of his experience. His findings, that heavier purchasers received thinner discounts is presented as betrayal, not as a data point that might complicate the “loyalty programs are pure surveillance” thesis, since it’s consistent with the logic that a company doesn’t always need to provide incentives to customers who are well established.

Both articles miss the core understanding that a loyalty program is a value exchange: the customer trades some data and attention for discounts, points, or perks. Reasonable people can disagree about whether that exchange is currently fair and whether the value returned is proportionate to the data given up. You can also challenge whether the terms are clear enough at sign-up.

That’s a real debate worth having. But both stories skip past it entirely and jump straight to treating the evidence of the exchange — the transaction log — as if it were evidence of wrongdoing in itself.

A 515-page file is not proof of exploitation. It’s proof of years of visits, offers, and redemptions, mandated into readable form by a state privacy law that requires exactly that level of disclosure.

The size of the file is a function of the length of the relationship and the strength of California’s transparency requirements — not a measure of harm.

A Detail Both Stories Buried

There’s a fact worth surfacing because it undercuts the framing of loyalty programs as “surveillance marketing” directly. Wired’s own social media promotion of the Rogers story noted, almost as an aside, that unlike other companies scrutinized in this space, McDonald’s doesn’t appear to sell this data to third parties.

That’s a meaningful distinction from Kroger, Hertz, or Macy’s — companies the Vanderbilt Policy Accelerator’s “Loyalty Trap” report cites for sharing loyalty data with dozens of outside firms, from data brokers to insurers.

If McDonald’s isn’t doing that, the actual complaint in the Rogers story isn’t data monetization — it’s that the file is long and the predictions inside it are unsettling to read. That’s a different problem than the one the headline implies.

What’s Actually Fair Criticism Here

None of this means the industry gets a pass. Carnegie Mellon privacy researcher Lorrie Cranor, quoted in the Wired piece, made the most useful point in either story: 500 pages is “a wake-up call,” not because it’s evidence of misuse, but because “it’s not in a format that people will readily understand.”

That’s worth taking seriously and something you should consider before you tout your ability as a marketer to execute “hyper personalization at scale” in your next conference presentation.

Most loyalty programs disclose extensively at the point of a CCPA request and minimally at the point of enrollment — exactly backwards from what would build trust.

A short, plain-language summary of what’s collected and why, delivered when someone signs up rather than buried in a privacy policy, would do more to defuse this recurring story than any statement issued after the fact.

The Reframe Loyalty Marketers Should Make

The optimal response to both stories isn’t defensive. Instead, it should provide a clear explanation of what marketers are doing with the data they collect. A large file reflects an active, voluntary relationship. It is not, by itself, evidence of surveillance – or anything else negative in nature.

We should expect to see more reporters conflating the two. Maybe they should be asked whether they’d also call a bank statement or a phone bill a “dossier.” And possibly there should be more concern about auto insurance discounts tied to the requirement to place a digital monitoring device in your vehicle – and setting location services to “always on”.

Loyalty marketers who can make their case for data collection and show value to customers through a strong value proposition that benefits the customer can get ahead of this wave of “discovery journalism.”

In doing so, marketers can address the readability problem Cranor identifies. Brands that recognize this tipping point in consumer understanding of loyalty programs (and other forms of incentive-laden, data-driven marketing) will preserve more trust with customers.

They will also be far better positioned than those who either ignore the story or over-apologize for a business model that, done transparently, still works exactly as advertised: value for data, given knowingly, by choice.