Delivery bots accused of illegally scanning customers

Two Chicago customers say robots delivering their groceries and takeout scanned their faces and hands without consent, stored the data alongside their names and addresses, and used the recordings to train AI . Their separate lawsuits accuse delivery robot operators Coco Robotics and Serve Robotics of violating Illinois’ biometric privacy law. Both companies dispute the claims. The plaintiffs filed the cases in the Circuit Court of Cook County, Illinois, alleging that the robots used their cameras along with light detection and ranging (LiDAR) sensors to scan them. LiDAR uses laser pulses to build a detailed 3D map of a robot’s surroundings. The lawsuits allege that, at close range, these sensors capture facial geometry in enough detail to support facial recognition. Mitchell Breidinger ordered DoorDash groceries in September 2025. A Coco robot, operated by Coco Robotics, made the delivery. To collect it, he had to stand within about a meter of the robot’s cameras and LiDAR sensor while he entered a PIN code in the DoorDash app, and a Coco remote pilot watched the live video, according to the complaint . Barry Schain filed a similar complaint against Serve Robotics, which sent one of its robots to deliver his Uber Eats order. The complaint against Cyan Robotics (the California-based company that does business as Coco Robotics) states that the robots record detailed 360-degree LiDAR data on the urban environments that they navigate. Coco has never said that it blurs, downsamples, or removes human faces or hands from that LiDAR data, the complaint adds. It also says the company: “gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule.” Those who are scanned by Coco robots have no account to close with the robotics company and don’t get to choose whether they are served by a robot, the complaint points out. Cyan uses the data that the robots collect to train its AI, the complaint says, adding that it also has data-sharing partnerships with companies including ChatGPT creator OpenAI. Schain, who most recently took a delivery from a Serve robot on October 4, makes similar claims in his complaint. The company fulfills food delivery orders for both Grubhub and Uber Eats, it says, noting (unlike the complaint against Cyan) that these robots also collect audio. Serve Robotics licenses video and LiDAR data to third parties for model training, the complaint says, citing Serve’s own filings with the Securities and Exchange Commission. Both companies have pushed back, according to reports . Coco said it has not collected biometric data in Chicago, that the suit “fundamentally misunderstands our technology” and that “the data we share is navigational data used to make sidewalks safer for all users.” It called the case “frivolous.” Coco said that it doesn’t share data from the beginning and end of delivery runs. Serve said that the robot systems are “not designed to identify individuals or create biometric profiles.” Whether the data the robots capture qualifies as biometric information under BIPA is central to the lawsuits. Illinois’ biometric law Illinois’ biometric privacy law gives people the right to sue companies over the unlawful collection and use of their biometric data. Under that law, biometric identifiers include scans of hand and face geometry. Companies must tell people in writing what biometric information they’re collecting, what they’ll use it for, and how long they’ll keep it. They must also get each person’s written consent and publish a schedule for destroying the data, and they must not sell or otherwise profit from it. These class action suits were not delivered in a vacuum. Chicago residents had already mounted a petition against the delivery robots, citing collisions, interference with emergency vehicles, and concerns about potential surveillance. More than 4,550 Chicagoans have signed it, the petition says. Both suits were filed by the same Chicago law firm, Almeida Law Group. Each seeks $1,000 per class member for negligent violations or $5,000 for intentional or reckless ones. Each complaint says its proposed class “includes many thousands of persons.” Browse like no one’s watching. Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → About the author Danny Bradbury has been a journalist specialising in technology since 1989 and a freelance writer since 1994. He covers a broad variety of technology issues for audiences ranging from consumers through to software developers and CIOs. He also ghostwrites articles for many C-suite business executives in the technology sector. He hails from the UK but now lives in Western Canada.