WIRE 10.09.2026Commission opens formal AI Act proceedings against two model providersECB digital euro pilot names first Belgian banksAgeas, AXA, Allianz sign joint letter on cloud exit clausesBelgium's NIS2 transposition enters force 18 October
All wire
Hosaka Seven

Tech, policy and power. For the people who have to sign off on it.

Policy

McDonald's is selling third-party advertising on 450 of its drive-thru boards. It operates those 450; franchisees paid for the other thirteen thousand.

The company presents it as growth, and a network like this takes years to build, so it is not an answer to one soft quarter. Nothing has been said about Europe, where the new single app platform reaches France this year and ten owned markets by the end of 2028.

A drive-thru lane at dusk, seen from a car waiting behind another. The illuminated order board ahead gives its top third to an advertisement for a running shoe and its lower two-thirds to a grid of food items with their prices. A small aluminium asset tag is bolted to the board's frame at eye height, stamped OWNED 450. A kerb runs along both sides of the lane, narrowing it to a single width with no gap to pull out through.

Draft, not yet edited. Written by Nadia Berger, and not yet through the desk: nothing here has been checked against the sources listed at the foot of the page. Do not act on it.

The screen you order from at a McDonald's drive-thru in the United States may now show you an advertisement for something McDonald's does not sell. It has done so since August, at 450 restaurants. The company did not say so publicly until 23 September.

That is the date of its investor day in Chicago. The release McDonald's filed with the Securities and Exchange Commission that morning runs to three pages of targets to 2030 — a percentage point and a half of chicken share, the same again in beverages, operating margin in the low-to-mid 50% range, about 250 basis points of restaurant-level efficiency, about $8.5 billion of partnering support to franchisees through 2036. It does not contain the word advertising.

The McDonald's Media Network was described from the stage instead. Morgan Flatley, the global chief marketing officer, said the pilot had begun the previous month across 450 US company-owned restaurants, and that the aspiration is to build it into a billion-dollar business. She called it revenue with, in her words, "no disruption to our customer experience". We read a third-party transcript of the day rather than the company's own, because there is no company transcript we could find, and the filing carries none of it.

CNBC, which reported the announcement that afternoon, says the placement is the digital drive-thru order boards and that the pilot has not reached the franchisees who operate the rest of roughly 14,000 US restaurants. Trade coverage says the advertisement appears once the order is complete. We could not establish that from the company and will not print it as fact. It matters less than it sounds. Either way a customer who came for a burger is queueing in front of an advertisement for something else, in a lane with a painted kerb on both sides and no gap to pull out through — and that last fact is the only property of the inventory nobody disputes.

Take the company's version first, because it is the likely one

A retail media network is not a quarter's work. Amazon and Walmart built theirs from strength rather than weakness, and Amazon reported $68.6 billion of advertising service sales in 2025 on CNBC's figures. Flatley put the US commerce media market above $100 billion by 2028. On that framing this is a company with 45,356 restaurants noticing late that it owns a great many screens, which is a question any board would ask.

The framing also survives the obvious objection. None of it is a response to one soft quarter, because none of it could be. A pilot running in August was commissioned long before the August results.

So the honest version of the sceptical reading is not that McDonald's is reacting. It is that a business builds this when it has concluded that each visit needs to be worth more, and that the levers it has been using to make each visit worth more have stopped working.

A segment went backwards for a year, and it was nothing to do with the food

Comparable sales exclude currency and hyperinflationary markets, which makes them the right series for a question about demand and the wrong one for a question about revenue. Read the three segments together across twelve quarters and the shape is not subtle.

The same figures, as read.
QuarterUSInternational operatedDevelopmental licensed
Q3 23+8.1%+8.3%+10.5%
Q4 23+4.3%+4.4%+0.7%
Q1 24+2.5%+2.7%-0.2%
Q2 24-0.7%-1.1%-1.3%
Q3 24+0.3%-2.1%-3.5%
Q4 24-1.4%+0.1%+4.1%
Q1 25-3.6%-1%+3.5%
Q2 25+2.5%+4%+5.6%
Q3 25+2.4%+4.3%+4.7%
Q4 25+6.8%+5.2%+4.5%
Q1 26+3.9%+3.9%+3.4%
Q2 26+0.8%+1.5%+1.9%
The developmental licensed segment ran from +10.5% to −3.5% in four quarters while the other two were still growing. McDonald's own releases named the war in the Middle East in the commentary on that segment for each of those four quarters, and in the 2024 annual report. By the fourth quarter of 2025 the same segment was growing again. Nothing about the food changed in either direction.Exhibit 99.1 to Form 8-K for each quarter from Q4 2023 (filed 5 February 2024) to Q2 2026 (filed 4 August 2026), plus Q3 2023 as the prior-year comparative in the Q3 2024 release. Percentages are comparable sales against the same quarter a year earlier.

The developmental licensed segment is the one that carries the Middle East, among more than seventy-five countries. In the fourth quarter of 2023 it grew 0.7% while the US grew 4.3% and the international operated markets 4.4%. Three quarters later it was down 3.5%. The 2024 annual report puts the full-year decline of 0.3% down to the continued impact of the war in the Middle East and to negative comparable sales in China. The word boycott appears once in that document, in a generic risk factor about economic action, and is attached to no result. The company's own word for what happened is war.Worth being precise about what the filings do and do not say. They name a cause for a segment. They do not quantify it, separate it from China, or name a country. A reader who wants the Middle East on its own will not find it in an SEC filing.

That is the demonstration. For four consecutive quarters, a segment covering a quarter of the world went sideways and then backwards for reasons that had nothing to do with the price, the product or the service, and the company said so in writing. No menu decision would have fixed it. Neither would 250 basis points of restaurant-level efficiency.

The case against reading it that way

State it at full strength, because it is strong.

The effect faded. The developmental licensed segment turned positive in the fourth quarter of 2024, up 4.1%, and has grown in every quarter since; for the full year 2025 it grew 4.6%, the best of the three segments. If exposure to a shock the company cannot control were the motive, the motive weakened two years ago.

The recent weakness is also somewhere else entirely, and management has explained it operationally. In the second quarter of 2026 the US grew 0.8% with guest counts falling. On the August call, executives said restaurant teams were overwhelmed by too many deployments, that service times rose and satisfaction scores fell, that value execution accounted for about two-thirds of the traffic underperformance, that only 60 to 65% of the system was running the recommended pricing architecture, and that April lapped the previous year's Minecraft campaign. A new president of McDonald's USA was announced in the same release. None of that is a company saying its demand is structurally exposed. It is a company saying it ran the quarter badly.

And a media network is simply a normal thing for a large retailer to build in 2026. Reaching for a geopolitical explanation when a commercial one is sitting on the table is the sort of move this publication is meant to be suspicious of.

The chart does not tell you what the board concluded. It tells you what there was to conclude something from.

The third rent on the same square metre

Here is the reading, and it is ours. McDonald's has not said it and will not.

The company already makes money from a restaurant three ways over. It takes a royalty on a percentage of the franchisee's sales. It generally owns or holds a long lease on the land and the building, and takes rent. And it sells food in the restaurants it operates itself. Two of those three are a claim on somebody else's turnover, which is to say they move when demand moves.

Advertising is the first line that does not. What an advertiser pays for a slot on an order board is a function of how many cars pass it, not of what those cars buy, what beef costs, or whether the pricing architecture has been deployed correctly in that market. It is the same square metre, let a third time, to a tenant who does not care what is on the tray.

That is not independence from demand, and we should not pretend it is. Empty the lane and the slot is worth nothing. But it is independence from every lever that has actually gone wrong in the last three years: the menu, the price, the ticket time, and a war. A board looking at the chart above would be negligent not to want a revenue line with that property, whether or not anyone in the room used the word exposure.

The scale is also worth holding lightly. A billion dollars was described as an aspiration across the McDonald's system, which is not the same number as a billion of the company's own revenue, and nobody said which. For comparison, the only line in the accounts that holds money from neither restaurant sales nor rent nor royalties — Other revenues, being technology fees from franchisees and brand licensing — came to $647 million in 2025.

The screen has an owner, and it is usually not McDonald's

This is why the pilot is company-operated restaurants only, and it is not a technology problem.

The 10-K is explicit about the conventional franchise arrangement: the company generally owns or secures a long-term lease on the land and the building, and the franchisee pays for "equipment, signs, seating and décor". Approximately 95% of the 45,356 restaurants are franchised. In most of the estate, the operator bought the screen.

So every step beyond 450 restaurants is a negotiation with somebody who owns the inventory, has paid to maintain it, is being asked to accept about $8.5 billion of partnering support for a modernisation programme at the same time, and will reasonably ask which side of the table banks the advertising revenue. Flatley's "no operational complexity" is true of the 450. It is a claim about the other thirteen thousand that nobody has tested, because nobody has asked them yet in public.

What would have to be true before any of this reached the EU

Nothing has been announced for Europe. What has been announced is the plumbing: a single global mobile application platform, piloting in France later this year and scaling across the ten largest owned markets by the end of 2028. Targeting across kiosks, boards and an app implies loyalty accounts, order history and device identifiers. No one at the investor day connected the data foundation to the advertising business, and we are not connecting it for them. But the questions a European deployment would have to answer are answerable now, and three of them bite.

The basis for the profiling. Under the GDPR, selecting an advertisement from a person's order history is profiling within Article 4(4) — automated processing used to evaluate personal aspects including preferences, interests, behaviour and location. It needs a lawful basis. Consent under Article 6(1)(a) means nothing happens until somebody says yes. Legitimate interests under Article 6(1)(f) means it starts and the person may object. Which one is chosen will not be visible in the product, and Article 6(1)(f) ends with a clause that will matter in a restaurant: the interests of the controller give way where the data subject is a child.

The device, which is a separate question. Article 5(3) of the ePrivacy Directive requires consent to store information on, or read information already stored in, a user's terminal equipment, after clear and comprehensive information. It does not care whether the information is personal, and it is not satisfied by whatever basis was chosen for the GDPR question. An identifier read from a phone to pick an advertisement is a consent question on its own terms, in twenty-seven differently transposed versions.

The right to object, and where it is kept. Article 21(2) makes objection to direct marketing absolute — no balancing, no compelling grounds, and it covers the related profiling. Article 21(3) says the processing then stops. Article 21(4) is the one to read twice: the right must be brought to the person's attention at the latest at the time of the first communication, clearly and separately from any other information. An opt-out at the foot of a privacy notice is not that.

Then the two instruments everyone will reach for, which do not reach back. The Audiovisual Media Services Directive protects minors from commercial communications in Article 9(1)(g), but Article 9 binds media service providers, and an audiovisual commercial communication is defined as images accompanying or included in a programme or a user-generated video. A drive-thru order board is not a programme. Article 9(4) on food high in fat, salt and sugar does no more than have Member States encourage codes of conduct, and only for children's programming. The Digital Services Act forbids advertising based on profiling to a person the provider reasonably believes is a minor, in Article 28(2) — but it binds providers of online platforms, and an online platform under Article 3(i) is a hosting service that stores and disseminates information to the public. A restaurant ordering app does not. We found no guidance or case law on in-restaurant screens either way.

Which leaves the children question where nobody has organised it: in national advertising rules that differ by Member State, in a room that reliably contains children, in front of a screen that is not broadcast, not an online platform, and not going anywhere. We have not opened those national rules and make no claim about them.

The company's own risk factors say that as it expands digital engagement, data collection and personalisation through AI it faces new and heightened risks, and name the GDPR, US state law and the EU AI Act. They do not name ePrivacy. They do not name the Digital Services Act. Nor, as of the 2025 annual report filed in February, do they name a media network at all.

The third-quarter release is due late October. The document that would actually settle this is the first agreement with a franchisee to sell time on a screen the franchisee paid for, and that one is not filed anywhere.

Primary The document itself. Claims in this piece rest only on these.

  1. Form 8-K and Exhibit 99.1, investor release of 23 September 2026 (McDonald's > NEXT targets)McDonald's Corporation, filed with the SEC (CIK 0000063908), accession 0000063908-26-0000762026-09-23Read in full, with the cover 8-K. Source for the NEXT financial targets printed here: +1.5pp chicken and beverage share by 2030, operating margin in the low-to-mid 50% range by 2030, about 250 basis points of gross restaurant-level efficiency, about $8.5 billion of partnering support through 2036 including about $5 billion through 2030, G&A about 1.9% of Systemwide sales, and the loyalty figure of nearly 220 million 90-day active members across 70 markets. Also the source for the negative finding the body leads on: the release announces no advertising business, and the words advertising, media network and retail media do not appear in it or in the cover 8-K. Item 7.01 was filed under Regulation FD; nothing in it was said to be material.
  2. Quarterly comparable sales, Exhibit 99.1 to Form 8-K, eleven consecutive quartersMcDonald's Corporation, filed with the SEC (CIK 0000063908)2026-08-04Every figure in the drawing comes from one of these releases, read as filed, and each release carries the quarter and the prior-year comparative. Filed 5 Feb 2024 (Q4 2023: US +4.3%, IOM +4.4%, IDL +0.7%, total +3.4%, and the IDL commentary naming the war in the region); 30 Apr 2024 (Q1 2024: +2.5, +2.7, −0.2, +1.9); 30 Jul 2024 (Q2 2024: −0.7, −1.1, −1.3, −1.0); 29 Oct 2024 (Q3 2024: +0.3, −2.1, −3.5, −1.5, and Q3 2023: +8.1, +8.3, +10.5, +8.8); 10 Feb 2025 (Q4 2024: −1.4, +0.1, +4.1, +0.4); 1 May 2025 (Q1 2025: −3.6, −1.0, +3.5, −1.0); 6 Aug 2025 (Q2 2025: +2.5, +4.0, +5.6, +3.8); 5 Nov 2025 (Q3 2025: +2.4, +4.3, +4.7, +3.6); 11 Feb 2026 (Q4 2025: +6.8, +5.2, +4.5, +5.7); 7 May 2026 (Q1 2026: +3.9, +3.9, +3.4, +3.8); 4 Aug 2026 (Q2 2026: +0.8, +1.5, +1.9, +1.3). Four consecutive releases — Q4 2023 through Q3 2024 — attribute the developmental licensed segment's performance in part to the war in the Middle East; that is the band in the drawing. None of the eleven uses the word boycott. Comparable sales exclude currency translation and hyperinflationary markets, which is why they are the right series for this argument and the wrong one for anything about revenue.
  3. Exhibit 99.1 and Exhibit 99.2 to Form 8-K, second quarter 2026 resultsMcDonald's Corporation, filed with the SEC (CIK 0000063908), accession 0000063908-26-0000672026-08-04Both exhibits read. Source for: US comparable sales of +0.8% driven by positive check growth including favourable product mix and partly offset by negative comparable guest counts; the appointment of Skye Anderson as President of McDonald's USA and Chris Kempczinski's stated opportunity to raise the bar in the US; half-year comparable sales of +2.3% US, +2.6% IOM, +2.6% IDL; and the privacy risk factor, which names the GDPR and US state law and says that as the company expands digital engagement, data collection and personalisation through AI it faces new and heightened risks including under the EU AI Act. Neither exhibit mentions advertising inventory, a media network or retail media, and the risk factors name neither the ePrivacy Directive nor the Digital Services Act.
  4. Annual Report on Form 10-K for the year ended 31 December 2025McDonald's Corporation, filed with the SEC (CIK 0000063908)2026-02-24Searched and read in the relevant parts, not cover to cover. Source for: 45,356 restaurants at year-end 2025 of which approximately 95% were franchised; the description of the conventional franchise arrangement, under which the Company generally owns or secures a long-term lease on the land and building and the franchisee pays for equipment, signs, seating and décor; annual comparable sales of +2.1% US, +3.2% IOM, +4.6% IDL and +3.1% total for 2025 against +0.2%, −0.2%, −0.3% and −0.1% for 2024 and +8.7%, +9.2%, +9.4% and +9.0% for 2023; the composition of Other revenues, being franchisee fees recovering technology and digital platform costs plus brand licensing for consumer packaged goods, at $647 million in 2025 against $423 million in 2024. The words media network and retail media do not appear. Boycotts appear once, in a generic risk factor about economic action, and are not attributed to any result.
  5. Annual Report on Form 10-K for the year ended 31 December 2024McDonald's Corporation, filed with the SEC (CIK 0000063908)2025-02-25Searched and read in the relevant parts. Source for the 2024 annual figures and, more usefully, for the company's own written attribution in its annual report: the developmental licensed segment's 0.3% decline is put down to the continued impact of the war in the Middle East and negative comparable sales in China. Boycotts again appear only as a generic risk factor. This is the closest the filings come to naming an external cause for a segment going backwards, and it is as far as the body goes.
  6. Regulation (EU) 2016/679 (GDPR), consolidated textOfficial Journal of the European Union, OJ L 119, 4.5.20162016-04-27Opened and searched for this piece. Read: Article 58(2) in full, Article 83(1) to (4), and recitals 148 and 151. Source for the ten corrective powers and their order; for Article 83(2) being framed as 'in addition to, or instead of' the measures in points (a) to (h) and (j) of Article 58(2); for the eleven factors in Article 83(2)(a) to (k); for the wording of recital 148 including the reprimand sentence; and for recital 151 on Denmark and Estonia. Source too for the count printed in the body: a case-insensitive search of the whole text returns the string 'minor' once, in recital 148, and not once in the enacting terms or the annex. Article 83(7) was read for an earlier piece and is not relied on here beyond the guidelines' own paragraph 2.
  7. Directive 2002/58/EC (ePrivacy), consolidated text as amended by Directive 2009/136/ECOfficial Journal of the European Union, OJ L 201, 31.7.20022002-07-12Article 5(3) and Article 13 read in the consolidated version at 19 December 2009. Source for: the rule that storing information on, or gaining access to information already stored in, a subscriber's or user's terminal equipment requires consent after clear and comprehensive information, with the narrow exemptions for transmission and for what is strictly necessary to provide a service the user explicitly requested; and Article 13(1) and (2) on direct marketing by electronic mail. Both provisions reach a mobile application and neither depends on the data being personal. The consolidated text still refers to Directive 95/46/EC; national transposing laws were not opened, and they differ, which the body says.
  8. Directive 2010/13/EU (Audiovisual Media Services Directive), consolidated text as amended by Directive (EU) 2018/1808Official Journal of the European Union, OJ L 95, 15.4.20102010-03-10Read for this piece: Article 1(1)(a) and 1(1)(h), and Article 9 in full. Source for the negative finding in the body. An audiovisual media service requires a service whose principal purpose is providing programmes to the general public by means of electronic communications networks; an audiovisual commercial communication is defined as images that accompany or are included in a programme or a user-generated video; and Article 9(1), including the protections for minors in Article 9(1)(g), binds media service providers under a Member State's jurisdiction. Article 9(4) does no more than have Member States encourage codes of conduct, and only for communications in children's programmes. On the face of the text a drive-thru order board is none of those things. We found no case law or Commission guidance on in-restaurant screens and did not look for national interpretations.
  9. Regulation (EU) 2022/2065 (Digital Services Act)Official Journal of the European Union, OJ L 277, 27.10.20222022-10-19Read for this piece: Article 3(i) and 3(r), and Article 28 in full. Source for the second negative finding. An online platform is a hosting service that stores and disseminates information to the public at a recipient's request; an advertisement is information presented by an online platform on its online interface against remuneration. Article 28(2) forbids presenting advertisements based on profiling to a recipient the provider knows with reasonable certainty is a minor, and it binds providers of online platforms. A restaurant ordering application does not store and disseminate information to the public, so on the face of the text neither the definition nor the prohibition reaches it.
  10. National rules on advertising food to children in the Member StatesNot opened. Several Member States restrict the marketing of food high in fat, salt or sugar to children by statute or by code, and the rules differ in scope, age threshold and enforcer. Nothing in the body rests on any of them; the body says only that this is where the question lands once the two Union instruments above are read, and that we have not established what any national rule would do to a screen in a restaurant.

Reporting Attributed, not relied on. Where the reporting is the fact, it says so.

  1. McDonald's Investor Day 2026, transcript of the presentationsTranscript published by StockAnalysis2026-09-23A third-party transcription of remarks made by McDonald's executives. We did not hear the webcast and the company has published no transcript we could find, so every statement taken from it is attributed in the body to what was said from the stage rather than stated in our own voice. Source for: Morgan Flatley on the pilot beginning the previous month across 450 US company-owned restaurants, on the aspiration to build the McDonald's Media Network into a billion-dollar business, and on the quoted phrase about no disruption to the customer experience; Dario Baroni on the Global Mobile App One pilot beginning in France later this year and scaling across the ten largest owned markets by the end of 2028; Brian Rice on the data lake spanning over 46,000 restaurants. It does not establish which screens carry advertising, when in the order an advertisement appears, what data are used to select it, whether franchisees have been asked, or any plan outside the United States. Nobody connected the data foundation to advertising and the body does not.
  2. Why McDonald's is following Walmart and Amazon into the advertising businessCNBC2026-09-23Read in full and attributed in the body. Source for: the placement being the digital drive-thru order boards; the pilot not having reached the franchisees who operate the rest of roughly 14,000 US restaurants; the $1 billion figure; Flatley's commerce-media sizing of more than $100 billion in the US by 2028; Ian Borden's remarks to CNBC about reach. Also the comparators: Amazon's $68.6 billion of advertising service sales in 2025, and Walmart's statement that Connect grew 43% in its fiscal second quarter, neither of which we checked against those companies' own filings. The body uses them only as scale, not as a claim about either business.
  3. McDonald's second quarter 2026 earnings call, 4 August 2026, transcriptTranscript published by Investing.com2026-08-04A third-party transcription, attributed in the body as what management said on the call. Source for the operational explanation of the US quarter: restaurant teams overwhelmed by too many deployments, service times rising and satisfaction scores falling, value execution accounting for about two-thirds of the traffic underperformance, only 60 to 65% of the system executing the recommended pricing architecture, a slightly negative April lapping the prior year's Minecraft campaign, and the June FIFA campaign underperforming expectations. Nothing was said on this call about advertising, a media network or monetising screens, in the same month the pilot is now said to have begun. Analyst consensus for the third quarter of 2026 was not established for this piece and no forecast is printed.

Lead Pointed us at the story. Nothing here is cited as authority.

  1. Trade coverage of the McDonald's Media Network pilotPPC Land, Gizmodo, Marketing Dive, MediaPostThese pointed us at the story and are not relied on for anything. The one detail worth naming is that trade coverage, originating with Gizmodo, reports that the advertisement appears once the customer's order is complete. We could not establish that from the company or from the investor day transcript and the body says so rather than printing it. Also unestablished from any source: whether loyalty accounts, order history or device identifiers are used to select an advertisement, what technology sits behind the pilot, how impressions are measured, and what a franchisee would be paid.

Nadia Berger

Platforms

I write about AI in the enterprise: who is deploying it, who is regulating it and who is quietly getting it wrong. I like a good hype cycle almost as much as watching one deflate.