McDonald's Consent System

2025-26

McDonald's Consent System is a framework created for legal, product, and marketing teams to align on shared experience guidelines to implement new consents and permissions. I co-designed a global consent framework that keeps 50M+ registered customers legally compliant across 100+ markets

Developed the end-to-end consent playbook governing registration, re-consent, and permission settings globally

Translated complex legal and regional requirements (GDPR, CCPA, and 100+ market variants) into a unified, user-friendly design system

Designed interaction frameworks distinguishing mandatory, opt-in, and granular consent, considering appropriate UI patterns and copy constraints

my role
Lead Designer

accompanying team
UI Designer
UX Researcher
Content Designer
Product Manager

project duration
2 months

process

01. discovery: four leading principles

Transparency drives loyalty when it's clear, honest, and leads with value. Testing across 990 participants allowed us to align on four leading experience principles.

02. develop a layered consent system

Layer 1. Activation & Registration Consent

Required checkboxes for mandatory, binding agreements (T&Cs, Privacy Policy) — cannot proceed without completion

Opt-in toggles for optional permissions (marketing, personalization, data sharing) — defaults to off, clearly labeled as changeable anytime

Layer 2. Re-Consent Guidelines

A tiered system for when existing permissions change or expire, considering how and when they show up during a user's app engagement.

Layer 3: Permission Settings

A consolidated Privacy & Communications page lets customers view and adjust all optional consents post-registration, giving them the flexibility and control they need as they engage with the app.

03. scale

The playbook covers the full consent taxonomy across every market variant:

Consent types documented: Explicit (mandatory), Explicit (optional), Implicit, Opt-in, Opt-out, Granular, and Consent Management/Preference Center

Global permission audit: Mapped 15+ consent categories across US, UK, Canada, Australia, Germany, and France—identifying which require checkboxes, which use toggles, and which are market-specific (e.g., California Privacy Notice, GDPR profiling opt-out)

Request a full case study