Delivery Robots Accused of Illegal Biometric Scanning Under Illinois Privacy Law
Two Chicago customers sue delivery robot operators for allegedly scanning faces and hands without consent to train artificial intelligence models.
Key points
- Lawsuits allege Coco Robotics and Serve Robotics collected biometric data via LiDAR and cameras without written consent.
- Plaintiffs claim the companies used facial and hand geometry scans to train AI systems, violating Illinois privacy statutes.
- Both vendors dispute the claims, stating their sensors capture navigational data rather than identifiable biometric profiles.
Two Chicago residents have filed lawsuits alleging that autonomous delivery robots scanned their faces and hands without permission. The complaints accuse operators of storing this biometric data alongside personal details and using the recordings to train artificial intelligence models. Both companies involved deny the allegations, characterising the suits as misunderstandings of their technology.
Root cause
The legal disputes centre on whether data captured by robot sensors qualifies as biometric information under Illinois law. Plaintiffs argue that light detection and ranging sensors, combined with cameras, record detailed three-dimensional maps of surroundings. At close range during PIN entry, these systems allegedly capture facial geometry sufficient for identification purposes.
Attack path
Customers interacted with robots by standing near them to retrieve orders. Mitchell Breidinger reported that a Coco robot required him to stand within one metre of its sensors while a remote pilot watched live video. Barry Schain filed a similar complaint regarding a Serve Robotics unit delivering an Uber Eats order, noting that these systems also collect audio data.
Affected versions
The complaints target specific delivery operations in Chicago rather than software versions. Mitchell Breidinger’s case involves a Coco Robotics unit delivering DoorDash groceries in September 2025. Barry Schain’s complaint concerns a Serve Robotics unit fulfilling an Uber Eats order on 4 October. Both companies operate multiple robot models in urban environments.
Mitigation
No technical patch or update has been confirmed by the vendors to address these privacy concerns. The companies state they do not collect biometric data or identify individuals through their systems. They describe the data as navigational information used to improve sidewalk safety. Legal resolution will determine whether current operational practices comply with state privacy requirements.
Why it matters
Teams usually assess how automated systems handle personal data during routine operations. Check whether sensors capture more than necessary for navigation. Verify that data collection policies clearly state purposes and retention periods. Ensure that users receive explicit notice before any recording occurs. Confirm that third-party data sharing agreements do not expose sensitive information. Review compliance with local privacy regulations regarding biometric identifiers.
Background: Biometric data
Biometric data theft is serious because fingerprints and facial maps cannot be changed like passwords. Once stolen, these unique biological traits provide attackers with permanent access to your identity, bypassing traditional security layers and creating lifelong risks for every system that relies on them for verification.
Read the full guide: Why is biometric data theft a serious concern for you
What to do and how to stay safe: Coco Robotics
- Review local privacy laws to understand rights regarding biometric data collection.
- Check terms of service for delivery apps to see how robot data is handled.
- Monitor legal developments in your jurisdiction concerning autonomous vehicle privacy.
- Contact consumer protection agencies if you believe your data was misused.
Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What law are the companies accused of violating?
The plaintiffs allege violations of Illinois’ Biometric Information Privacy Act, which regulates the collection and use of biometric data.
Do the companies admit to collecting biometric data?
No, both Coco Robotics and Serve Robotics dispute the claims, stating their systems are not designed to identify individuals or create biometric profiles.
How is the data allegedly used?
The lawsuits claim the companies use the scanned data to train artificial intelligence models and share it with third parties like OpenAI.
