The robot delivering your food could be collecting more than your delivery address, according to two lawsuits raising questions about biometric privacy on Chicago's sidewalks.
Separate complaints accuse Coco Robotics and Serve Robotics of collecting facial and hand-related biometric data without the notice and consent required under Illinois law. The lawsuits also raise questions about whether information captured during deliveries is retained or shared with third parties, including for AI training.
Both companies dispute the allegations. At the center of the cases is a question that could have implications beyond food delivery: when does information captured by an autonomous robot become legally protected biometric data?
Two lawsuits, one privacy problem
According to the Associated Press, two Chicago residents filed separate lawsuits against Coco Robotics and Serve Robotics, alleging that their delivery robots violated Illinois' biometric privacy law.
Mitchell Breidinger sued Coco Robotics over a grocery delivery made through DoorDash in September 20206. He alleges that he did not request robot delivery but received one anyway. According to the complaint, the robot's cameras captured images of his face, head and hands, while a remote operator could monitor the delivery in real time.
Breidinger's lawsuit further alleges that Coco failed to provide the required notice, disclose its data retention practices or obtain his written consent. The complaint also claims that Coco shared data collected by its robots with OpenAI and other third parties for AI training. Those allegations have not been established in court.
The second lawsuit targets Serve Robotics. Barry Schain, a resident of Lincoln Park, also alleged that he received three deliveries from Serve robots through Uber Eats, most recently on October 4, 2026.
Like the first person, Schain alleges that he never selected robot delivery and that the robots collected and retained biometric information from his face and hands without his permission.
Illinois' Biometric Information Privacy Act regulates the collection and handling of certain biometric identifiers, including scans of facial and hand geometry. The law generally requires covered private entities to provide written notice, disclose the purpose and duration of collection, and obtain a written release before collecting protected biometric information.
However, ordinary photographs and video recordings are not automatically considered biometric identifiers under the law. Whether the robots captured or generated information covered by BIPA will therefore be a central question in the cases.
The defendants deny any wrongdoing
Speaking to the Associated Press, a spokesperson for Coco said that the data it collects is for navigational purposes, which helps robot and pedestrian safety.
The spokesperson further noted that the “lawsuit fundamentally misunderstands” how its technology works and that the company is “confident that this frivolous lawsuit will go away.”
Serve, meanwhile, also said the data its robots collect is for road safety and added that the company “will defend against” the lawsuit.
Both lawsuits were filed on Oct. 9 in the Cook County court and seek statutory damages of $1,000 per violation of the state’s Biometric Privacy Act or $5,000 per intentional or reckless violation.
The question is what happens to your data
Autonomous delivery robots need cameras and sensors to navigate sidewalks, detect obstacles, and deliver orders safely. But where does the collected data end up, how long is it retained, and who else gets access to it? These questions matter because information collected to help a machine do its job may be retained or used for other purposes.
For consumers, the concern extends beyond the person receiving an order. Pedestrians who encounter these robots could also appear in their recordings, potentially without knowing what information is being collected about them or how it might be used.
If the allegations are substantiated, this could raise broader questions about how companies deploying autonomous machines in public spaces inform people about data collection and obtain legally required consent.
However, the allegations remain unproven in court. The plaintiffs must provide evidence that the robots collected legally protected biometric data and that the companies violated Illinois law. Both companies deny the allegations, and neither has been found liable.
For now, the lawsuits serve as a reminder that the ability to collect data is not the same as having the right to collect it.
As autonomous machines become more common in public spaces, companies must consider not only what their technology needs to function, but also what information it gathers about people who interact with it, what happens to that information afterward, and whether those practices meet their legal obligations.
Other news: Cybercriminals exploited a legitimate financial platform's open-banking features to verify stolen banking credentials and access account balances without initiating transactions.