But then that’s not McDonald’s using their data but selling it onwards for others to aggregate and use.

That’s the underlying fear and issue - and quite right.

Over the next decades we are going to gather and analyse soooo much data, and society will be dystopia or utopia based on what we let commercial entities and governments do with our data.

Not prevent them from collecting it because then all the good stuff cannot happen (epidemiology is going to rock in 2035) but preventing the bad usage.

I think a simple set of medical-like privacy laws (collect it, keep it locked down tight, use in the best interests of the citizen, do not sell onwards but share with licensed data brokers, introduce some cottage industry of data lawyers who can recover damages from dodgy data brokers)

That probably will be enough but interested in others views