Why on-device video generation is the only way QSRs can protect customer PII

Quick-service restaurant brands sit on some of the richest customer data in retail: order histories, location patterns, payment behavior, dietary preferences, and loyalty activity across millions of accounts. That data is a marketing asset and a compliance liability at the same time. Every time a QSR sends customer data to a third-party marketing vendor to personalize a video, that data leaves the brand’s control and lands on someone else’s server. For data and analytics teams responsible for GDPR, CCPA, and SOC 2 compliance, that transfer is the entire risk. On-device video generation removes it by keeping the data on the customer’s phone.

This piece is written for QSR data and analytics teams. It walks through what on-device generation means, why the traditional personalized video model creates a PII exposure, and how a zero-knowledge architecture closes it.

What is on-device video generation?

On-device video generation means the personalized video is assembled on the customer’s own phone at the moment they open it, rather than being rendered on a third-party server. The customer’s data is used to build the video locally and never leaves the environment where it already lives.

The contrast with the traditional model is the whole point. In the standard personalized video model, the brand exports customer data to a video vendor, the vendor’s servers render a personalized file for each customer, and the finished files sit on the vendor’s infrastructure until the customer opens them. The customer’s order history, name, and loyalty data have now been copied to a third-party server, which is exactly the transfer that compliance teams work to prevent.

On-device generation inverts the flow. The template and the rendering logic go to the device. The data resolves locally. Nothing sensitive is transmitted to or stored on the vendor’s servers.

Why does traditional personalized video create a PII exposure?

Personally identifiable information, or PII, is any data that can identify a specific person, including name, email, order history, location, and payment details. QSR loyalty data is dense with PII because it ties a named individual to a pattern of purchases and locations.

The traditional personalized video model exposes this PII in three places. The data in transit, as it moves from the QSR’s database to the vendor’s servers. The data at rest, as it sits on the vendor’s infrastructure during and after rendering. The rendered files themselves, which encode the customer’s personal data into a video stored on a third-party server. Each of these is a surface that a compliance audit has to account for and a breach could expose.

For a QSR brand, the exposure is not hypothetical. A vendor breach that exposes rendered loyalty videos would expose the order histories and identities of every customer in the campaign. The regulatory consequences under GDPR and CCPA, and the SOC 2 implications, make that a risk most QSR data teams are unwilling to carry.

How does a zero-knowledge architecture protect QSR customer data?

A zero-knowledge architecture means the personalization platform never sees, receives, or stores the customer’s PII, because the sensitive data resolves on the customer’s device rather than passing through the platform’s servers. The vendor has zero knowledge of the customer’s personal data.

Blings uses this architecture. The Dynamic Master Template and the rendering logic are delivered to the customer’s device. The customer’s data stays inside the QSR’s own environment and resolves locally at the moment of open. The video the customer sees is fully personalized, but Blings never received the order history, the name, or the loyalty balance that populated it. There is no data in transit to the vendor, no data at rest on the vendor’s servers, and no rendered PII-encoding files sitting in third-party storage.

For the compliance team, this collapses the audit surface. The customer data never left the QSR’s control, so the personalized video campaign does not introduce a new third-party data-processing relationship to document, assess, and monitor. For the deeper architectural context, see AI video personalization in 2026: why architecture matters more than the algorithm.

How does on-device generation map to GDPR, CCPA, and SOC 2?

The compliance mapping is direct. GDPR data minimization means a brand should limit the transfer and processing of personal data to what is strictly necessary. On-device generation transfers no personal data to the vendor at all, which is the strongest possible position under the principle. CCPA restricts the sale and sharing of personal information; with no data leaving the QSR’s environment, there is no sharing with the video vendor to disclose or restrict. SOC 2 assesses how a service organization handles customer data; a vendor that never receives the data has a dramatically narrower scope to audit.

The practical result is that on-device generation lets the QSR run fully personalized video campaigns while keeping the compliance posture identical to running no third-party personalization at all, because functionally, no third party ever touches the sensitive data.

What does on-device generation look like in production?

McDonald’s used Blings to power localized loyalty campaigns across multiple markets, with customer data including local store preferences and reward balances rendered into personalized video on demand. Because the rendering happened on-device through the zero-knowledge architecture, the sensitive order and reward data stayed within the brand’s environment rather than transferring to a third-party render farm.

Habit Burger Grill tied personalized video to each customer’s order history and location, lifting loyalty signups by 47% while keeping the order-history data on-device. See the Habit Burger Grill case study.

The privacy architecture does not cost engagement. Live Nation VIP produced a 17.55% lift in unique opens and a 16.6% share rate on personalized fan video that rendered on-device, demonstrating that the zero-knowledge model delivers the same engagement as any personalized video approach. See the Live Nation VIP case study.

The takeaway

For QSR brands, customer data is both the fuel for personalization and the largest compliance liability on the balance sheet. The traditional personalized video model forces a trade-off: personalize and accept the PII exposure of shipping data to a third-party render farm, or protect the data and give up personalization. On-device generation with a zero-knowledge architecture eliminates the trade-off. The customer data never leaves the brand’s environment, and the video is still fully personalized. McDonald’s, Habit Burger Grill, and Live Nation VIP all run personalized video on this model.

For a QSR data and analytics team, on-device generation is not just the better privacy option. It is the only approach that lets the brand run personalized video without expanding the compliance audit surface. The architecture is the compliance strategy.