Class Actions Accuse Delivery Robots of Scanning Biometric Data Without Consent
Two Chicago lawsuits allege Coco Robotics and Serve Robotics collected facial and hand data from customers in violation of state privacy laws.
Key points
- Coco Robotics and Serve Robotics face separate class-action suits over alleged biometric data collection.
- Plaintiffs claim the robots used cameras and LiDAR to scan faces and hands without written consent.
- Both companies deny wrongdoing, while the suits seek damages under the Illinois Biometric Privacy Act.
Two separate class-action lawsuits filed by Chicago residents accuse popular delivery robot manufacturers Coco Robotics and Serve Robotics of collecting customer biometric data without consent. According to a report from the Associated Press, the complaints allege that the companies used onboard cameras and sensors to scan the hands and faces of individuals picking up food orders.
The legal actions claim that these manufacturers violated the Illinois Biometric Privacy Act by failing to provide written notice or obtain written consent before recording biometric identifiers. The plaintiffs seek statutory damages of $1,000 per violation, or $5,000 per intentional or reckless violation, along with other relief. Both companies have denied any wrongdoing in response to the accusations, according to the AP.
Allegations of Surveillance and Data Use
The complaint against Coco Robotics details an incident where a plaintiff alleged the company’s delivery bot recorded his head, face, and hands using its cameras. The suit further claims the robot used LiDAR sensors to measure the geometry and distance of these body parts as the customer approached to retrieve a DoorDash order. The plaintiff also stated that a remote operator could watch the delivery video in real-time, none of which he had consented to.
Regarding Serve Robotics, the plaintiff alleges that the company’s bot, which was completing an Uber Eats delivery, collected and retained biometric information without permission. The lawsuit alleges that the company may be using that information to train artificial intelligence systems, including potentially licensing the data to third parties.
Legal Framework and Regional Context
Both lawsuits rely on the Illinois Biometric Privacy Act, which mandates strict protocols for firms collecting biometric data from state residents. The law requires companies to provide clear written notice of their collection practices and obtain explicit written consent from consumers. It also requires a clear policy for how that data is retained and destroyed.
The fact that both lawsuits originate in Chicago is significant, as the city has become something of ground zero for debates over the bots. The cases stem from residents of Chicago, where the deployment of autonomous delivery robots has been a subject of local discussion.
What should you do?
Residents of Illinois should review the terms of service and privacy policies associated with delivery apps that utilize autonomous robots. Consumers can check whether they have provided written consent for biometric data collection when using these services. Monitoring local news for updates on these class-action lawsuits may help individuals understand their potential rights.
Background: Biometric data
Biometric data includes physiological traits like fingerprints and facial geometry, or behavioral patterns like voice cadence. Systems convert these physical inputs into digital templates for identification. Unlike passwords, these traits are permanent. Loss of this data creates lifelong privacy risks that require strict consent and minimal retention practices to mitigate effectively.
Read the full guide: What Is Considered Biometric Data: Definitions, Risks, and Management
What to do and how to stay safe: Coco Robotics
- Review the privacy policy of your food delivery app to see if it mentions biometric data collection by robots.
- Check if you have signed any written consent forms related to data collection when using autonomous delivery services.
- Monitor official court filings or news updates regarding the Coco Robotics and Serve Robotics class-action lawsuits.
- Contact your state attorney general’s office if you believe your biometric data was collected in violation of state privacy laws.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific biometric data are the lawsuits claiming was collected?
The lawsuits allege that the robots collected data on customers' faces, hands, and head geometry using cameras and LiDAR sensors.
Which companies are being sued in these cases?
The two companies being sued are Coco Robotics and Serve Robotics, both manufacturers of autonomous delivery robots.
What law are the plaintiffs claiming was violated?
The plaintiffs claim the companies violated the Illinois Biometric Privacy Act, which requires written notice and consent for biometric data collection.
