In October, the Vanderbilt Policy Accelerator published research showing that companies use loyalty programs to hook consumers, creating a captive audience they can track. Because consumers opt into these programs in the hopes of discounts and rewards, the programs are exempt from many state and federal laws about surveillance. And some companies eagerly abuse that legal opening.

Of course, loyalty programs pre-date AI, not to mention the internet itself. But gone are the punch cards of yore. The Vanderbilt report’s lead example is the McDonald’s Monopoly game promotion, which has been around for decades but has now gone digital. Let’s say you win a food item on a peel-off token; to redeem it, you have to use the restaurant’s app, and that requires forfeiting one’s privacy:

To be eligible for these prizes, customers must agree to be tracked on far more than their Big Mac purchases. McDonald’s nearly 10,000-word privacy policy notes how the company can monitor customers’ precise geolocation, browsing history, app interactions, and social media activity. The company then uses this data to train its artificial intelligence models and build profiles on its customers—predicting their “preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.” McDonald’s leverages these psychological profiles to drive repeat customer engagement over time.

If McDonald’s succeeds in its goal of reaching 250 active loyalty users by 2027, the report adds, the company “will hold psychological and behavioral profiles on a quarter of a billion consumers—a scale rivaling that of a national intelligence agency.”