Chicago lawsuits allege delivery robots captured biometric data without consent
Two class actions claim Coco and Serve Robotics scanned faces and bodies during deliveries, violating Illinois privacy law.
Key points
- Plaintiffs allege unauthorized face and body scans by delivery robots in Chicago.
- Coco Robotics and Serve Robotics deny the allegations and call them frivolous.
- Suits seek statutory damages under the Illinois Biometric Information Privacy Act.
Two new class-action lawsuits filed in Chicago allege that autonomous delivery robots from Coco Robotics and Serve Robotics collected biometric data from residents without their permission. The plaintiffs claim that these companies used camera and LiDAR technology to scan their faces and hands while they retrieved food orders, a practice they say violates state privacy laws.
According to TechRadar, the cases center on the assertion that these scans occurred without explicit prior consent. The plaintiffs state that they did not request robot delivery through the apps, yet the autonomous vehicles arrived via DoorDash and Uber Eats. When the individuals unlocked the cargo bays to collect their items, the robots allegedly captured their biometric identifiers through onboard sensors.
Legal and corporate response
The lawsuits argue that this data collection breaches the Illinois Biometric Information Privacy Act of 2008. Under this statute, plaintiffs are seeking statutory damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation. The complaints further allege that the companies retained video and sensor data in violation of privacy regulations and shared this information with artificial intelligence companies for training purposes.
Both Coco Robotics and Serve Robotics have denied the allegations. According to the Associated Press, Coco Robotics described the legal action as "frivolous." Serve Robotics stated that it does not use data to identify individuals or create biometric profiles. The companies argue that scanning the environment is necessary for navigation around sidewalks and pedestrians, suggesting the plaintiffs fundamentally misunderstand the technology.
Privacy policies and data usage
The plaintiffs’ claims contrast with the companies’ published privacy policies. Coco Robotics’ policy, last updated in 2022 before operations began in Chicago, mentions sharing data with third parties but indicates most data is aggregated and anonymized. Serve Robotics’ more recent policy states that data retention is determined by contractual obligations with delivery partners.
Serve Robotics’ policy explicitly mentions sharing data to train AI agents and models. It also notes sharing information with unnamed service providers and vendors. The lawsuits contend that this sharing and retention of biometric data, specifically face and body scans, constitutes a violation of user privacy rights under Illinois law.
What should you do?
Readers in jurisdictions with biometric privacy laws should review the terms of service for delivery apps they use. It is important to understand how autonomous delivery services collect and process data during the handoff process. Users should be aware of their rights regarding consent for biometric data collection.
Background: Biometric data
Biometric data includes physiological traits like fingerprints and facial geometry, or behavioral patterns like voice cadence. Systems convert these physical inputs into digital templates for identification. Unlike passwords, these traits are permanent. Loss of this data creates lifelong privacy risks that require strict consent and minimal retention practices to mitigate effectively.
Read the full guide: What Is Considered Biometric Data: Definitions, Risks, and Management
What to do and how to stay safe: Coco Robotics
- Review your delivery app settings to see if you can opt out of autonomous delivery options.
- Check local privacy laws to understand your rights regarding biometric data collection.
- Monitor updates from the involved companies regarding their data retention and sharing policies.
- Document any instances where you feel your biometric data was collected without consent.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific biometric data do the lawsuits claim was collected?
The lawsuits claim that face and body scans were collected via camera and LiDAR technology.
Which companies are being sued in these Chicago cases?
Coco Robotics and Serve Robotics are the two companies named in the lawsuits.
What is the legal basis for these lawsuits?
The plaintiffs allege a breach of the Illinois Biometric Information Privacy Act of 2008.
