But then McDonald's could just buy the information. They don't need an app on my phone to get it.

Author here - they can only do surveillance pricing on you if they know who you are when you're paying. They can't do that at a kiosk or counter because they would only know whose paying when you use your credit card and have already seen the bill.

If you use an app they already know you who are and so the second you open the app it's showing you the surveillance prices.

But if they can get it from an app on your phone, they don't need to buy it. That seems pretty obvious.

It’s not because the app knows - your credit card company knows and it sells the information.