Yes, you are missing the scale of it. Once the computerized system is set up, probably by region or possibly only in one massive data location, all the information is transmitted wirelessly from each of its digital payment systems in each local McDonald's when every customer pays by credit card on online order. Once in the main system, it is automatically compiled by customer and analyzed by a variety of metrics—region, time of day, probable age or sex, typical spending, etc. A few big set-up costs for hardware, software and programming—divided by millions and millions of customers every day of the year.
Companies also build in some ways to measure whether the effects of their targeting are paying for themselves, such as tracking whether a customer's purchases increased as a result of digital ads personally selected to fit his profile.
It's all analyzed by algorithms without much human involvement unless there is a need for the company to study a specific type of behavior in their customer base, such as in a given region (southwest might prefer more Mexican-influenced spices, northeast might pump up the sales of hot chocolate for more months than the South, midwest might like a milder selection of dips, etc).
Companies that don't do data analysis are wasting a lot of money trying to run a one-size-fits-all approach in a huge nation that still has distinct regional variations. That's the general approach to enhanced supply-meets-demand systems. But this McDonald's dossier takes to to a very granular, individual level, to the point where their personalized advertising not only provides what the customer wants, but relentlessly pushes things he didn't know he would want. That is the traditional goal of advertising, but this is way beyond a print ad in a monthly magazine—personalized ads selected by the dossier will show up multiple times a week or a day on his smart phone, computer and digital tv.
The aggregate degree of tracking by almost all mega-corporations is becoming scary, due to their personally predictive models such as the McD's one described in the opening post. It's as if the local police could know when to stake out a given customer suspected of a crime by knowing when he would be most likely to show up at McD's or Costco. I'm not saying those companies are doing that or could be subpoenaed to divulge this info, but it's worth thinking about in terms of privacy.
Your post is very smart and thoughtful about how companies market and where the line is drawn between advertising and privacy.
I say, let the customer and consumer decide. If people don’t like what companies do, they can go somewhere else. Ain’t capitalism grand?