Privacy suits allege delivery bots scanned residents' faces without consent

Two proposed class-action lawsuits filed in Chicago allege that automated delivery robots from Coco Robotics and Serve Robotics captured biometric data from residents without their explicit permission. The plaintiffs claim these scans occurred while customers retrieved food orders, even though the individuals had not selected robot delivery in their respective apps. This legal action highlights growing tensions between automated logistics and personal privacy rights in public spaces.

According to reports from CNET and the Associated Press, the cases centre on whether the robots’ cameras and LiDAR sensors violated the Illinois Biometric Information Privacy Act. Plaintiffs Mitchell Breidinger and Barry Schain state they received unexpected robot deliveries via DoorDash and Uber Eats respectively. They allege that while entering pickup codes, their faces, heads and hands were scanned and measured without prior written notice or consent.

What we know

Mitchell Breidinger, a Cook County resident, said a Coco Robotics unit arrived at his home in September 2025 despite him not choosing robot delivery. He alleges the robot’s cameras captured his facial features and hands, while LiDAR technology measured the geometry of those body parts. Breidinger also claims a remote operator watched the delivery via video feed and that the company failed to provide written notice regarding data collection or retention periods.

Barry Schain alleges he received three deliveries from Serve Robotics through Uber Eats without having selected that option. Both lawsuits seek statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless breach. The plaintiffs argue that video and sensor data are being retained and shared with artificial intelligence companies for training purposes, which they contend violates state privacy statutes.

Both Coco Robotics and Serve Robotics have denied the allegations. A Serve Robotics spokesperson told CNET that its robots use sensors solely for safe sidewalk navigation and do not use data to identify individuals or create biometric profiles. Coco Robotics, via the Associated Press, called the legal action frivolous, stating it collects only navigational data to improve safety and does not share data from the start or end of trips.

Defender's checklist

• Review current privacy policies for any third-party logistics partners to understand data retention terms.
• Verify whether automated services require explicit opt-in consent for biometric data collection under local laws.
• Audit vendor contracts to ensure clauses prohibit the use of operational data for external AI training.
• Monitor regulatory updates regarding biometric information privacy acts in jurisdictions where operations occur.

The background in plain language

Biometric data refers to unique physical characteristics, such as facial geometry or hand structure, used to identify individuals. Privacy laws in some regions, like Illinois, require companies to provide written notice and obtain specific consent before collecting such data. Teams usually need to ensure that any sensor data gathered for navigation is anonymised and not retained for identification purposes. Check whether your organisation’s vendors clearly distinguish between operational safety data and personally identifiable biometric information.

What to do and how to stay safe: Coco Robotics

• Check your delivery app settings to see if robot delivery is automatically selected or if you can opt out.
• Review the privacy policies of delivery platforms to understand how sensor data from robots is handled and shared.
• Monitor local consumer protection news for updates on biometric privacy laws and any new consent requirements.
• Once the vendor provides an update, verify whether new notices or consent mechanisms are implemented for automated services.

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the plaintiffs request robot delivery in these cases?

No, both plaintiffs stated they did not select robot delivery in their apps, yet robots arrived at their locations.

What damages are the plaintiffs seeking?

The lawsuits seek $1,000 per negligent violation or $5,000 per intentional or reckless violation of the privacy act.

Do the companies admit to collecting biometric data?

No, both Coco Robotics and Serve Robotics deny the allegations, stating they do not use data to identify individuals.