Two Class-action Lawsuits Filed Against Food Delivery Robot Companies For Biometric Privacy Violations
Source: Chicago Tribune, Jane Miller
Photo: A Serve Robotics delivery robot is parked in the 2300 block of North Kenmore Avenue on the DePaul University campus in Chicago on May 19, 2026. (John J. Kim/Chicago Tribune)
Food delivery robots have become a constant in some parts of Chicago, where they are frequently seen wobbling down sidewalks with takeout orders. But two recently filed lawsuits allege that the robots are also collecting information on their travels.
Class-action lawsuits filed last week against food delivery robot companies Coco and Serve allege that the robot services scan the faces and hands of customers without their consent, using the biometric data to train the companies’ own AI models, and sharing the data with third parties. Both Serve and Coco Robotics deny the claims.
“A person’s biometric information is a core part of who they are,” wrote David Almeida and Lucas Coughlin, the counsel for both plaintiffs, in a joint statement. “Now that advanced AI systems allow companies to identify and track individuals solely by their biometric features, the risks of losing control of this data are greater than ever.”
According to the complaints filed in the Circuit Court of Cook County, the extraction of biometric data from both users of the food delivery services and people the robots encounter on their path violates the Illinois Biometric Information Privacy Act.
Enacted by the Illinois General Assembly in 2008, the act defines a biometric identifier as a retina or iris scan, a fingerprint, voiceprint, or a scan of hand or face geometry. The act requires that third parties inform individuals that they are being recorded and allow them to decide whether their biometric identifiers should be recorded, transmitted and used.
Mitchell Breidinger, who lives on the Near North Side, filed the lawsuit against Coco Robotics, and Barry Schain, who lives in Lincoln Park, filed the lawsuit against Serve Robotics. Both Breidinger and Schain allege that their biometric data was recorded by the delivery robot services and transmitted elsewhere without their consent, according to the complaints.
Breidinger is a DoorDash customer who received an order via a Coco delivery robot on Sept. 29, without having selected robot delivery, according to the complaints. Schain is an UberEats customer who received an order from a Serve delivery robot on Oct. 4, similarly without having selected robot delivery. According to the complaints, when an order is placed on a delivery app, the app may assign a delivery robot without the customer having selected that delivery mode.
Both Breidinger and Schain’s faces were scanned by the robots’ LiDAR sensors, a series of infrared laser lights that measure the three-dimensional geometry of a person’s face and hands, including “the distance from the sensor to the tip of the nose, the bridge of the nose, the cheekbones, the brow, the chin and jaw, and the shape and position of the hands reaching toward the robot,” according to the complaint.
These detailed geometrical measurements are “established means of identifying a person,” according to the complaint, and are kept in the system alongside the name and address of the individual who received the robot delivery.
“Even the most secure-seeming database is ultimately not that secure,” Coughlin said. “Cyber criminals, if nothing else, are extremely creative. The potential for misuse of this very sensitive data is almost limitless.”
Coco Robotics said it does not use LiDAR at all.
“We have never used LiDAR in Chicago and all data we collect complies with Illinois law,” the company wrote in a statement to the Tribune.
The company said the only data it shares is navigational data for public safety.
“For example, we provide real-time sidewalk hazard information to BlindSquare, a navigation app built for people who are blind or have low vision,” the company wrote. “We do not share data from the beginning or end of delivery trips under our datasharing partnerships.”
According to the complaint, in the case of Breidinger, the live video of him receiving his order was viewed by a Coco remote pilot, and transmitted to third parties, including OpenAI. In the case of Schain, the footage was distributed to third parties that “have processed Mr. Schain’s biometric identifiers for their own purposes.” The complaints said neither Breidinger nor Schain consented, and had they known their biometric data would be recorded and sent elsewhere, they would not have accepted robot delivery, or they would have declined the order.
Coco Robotics said it has not yet been legally served, and denied any violation of user privacy.
“This lawsuit fundamentally misunderstands our technology, we have not collected biometric data in Chicago, and we are confident that this frivolous lawsuit will go away,” Head of Government Relations at Coco Robotics, Carl Hansen, said in an email. “Privacy and compliance with privacy laws are a top priority at Coco and we believe these claims are meritless.”
Serve Robotics also denied the allegations.
“Serve Robotics is aware of the complaint and will defend against it,” the company said in an email to the Tribune. “Our robots use cameras and sensors to navigate the sidewalks of Chicago safely. Serve does not use that data to identify individuals and our systems are not designed to identify individuals or create biometric profiles.”
The lawsuits were filed on behalf of all customers who, at any time through the date of class certification, received an order placed through DoorDash, Uber Eats, GrubHub or any other third-party platform that was delivered by a Coco or Serve robot in Illinois, and who were recorded by that robot’s cameras or LiDAR sensor while in Illinois.
Per the biometric privacy act’s right of action policy, if the plaintiffs prevail in their cases, each person would be paid damages of $5,000 for each intentional or reckless violation, or alternatively $1,000 for each negligent violation.
“People should be aware that their biometric information is extremely sensitive,” Coughlin said. “The evolving nature of AI and cybersecurity threats only increases the need to protect this information and prevent third parties from using it in ways that may put you at risk.”
https://www.chicagotribune.com/2026/10/15/food-delivery-robots-lawsuit