Food delivery robots operated by Coco Robotics and Serve Robotics are accused of scanning customers' faces and hands without their consent, with lawsuits alleging that data collected by the machines is used to train artificial intelligence (AI) models.
Two Chicago residents have filed separate class-action lawsuits alleging that the companies violated Illinois' Biometric Information Privacy Act (BIPA) by collecting biometric information through cameras and light detection and ranging (LiDAR) sensors fitted to their delivery robots.
The complaints, filed in the Circuit Court of Cook County on 9 October, claim the robots capture facial and hand geometry at close range and that the information may be linked to personal details such as names, delivery addresses and order records.
Both companies dispute the allegations. The claims have yet to be tested in court. Although the complaints allege that robot-collected data is used to train AI models, they do not establish that the specific facial and hand measurements were used to identify individuals.
The cases also raise questions about whether customers can meaningfully refuse this data collection. The plaintiffs allege that delivery platforms may assign robots without customers choosing them, while the machines could also capture people they encounter on public pavements.
How Delivery Robots Allegedly Scan Customers
Mitchell Breidinger ordered groceries through DoorDash in September 2025 and received them from a robot operated by Cyan Robotics, which trades as Coco Robotics, according to his complaint.
To retrieve his order, Breidinger had to stand about a metre (3.3 feet) from the robot's cameras and LiDAR sensor while entering a PIN in the DoorDash app. A Coco remote pilot was watching the live video feed, the complaint alleges.
Barry Schain filed a similar lawsuit against Serve Robotics after receiving an Uber Eats order delivered by one of its robots. The complaint says his most recent delivery from a Serve robot took place on 4 October.
We aren't just deploying robots. We're building the operating layer of physical AI.@ahkashani digs into what that takes on the @RoadToAutonomy podcast. pic.twitter.com/OqFohcwOf1
— Serve Robotics (@ServeRobotics) August 25, 2026
The lawsuits allege that the robots' cameras and LiDAR sensors capture facial and hand geometry when customers approach to unlock the delivery compartment and collect their orders.
LiDAR works by emitting laser pulses and measuring how long they take to bounce back from surrounding objects. The measurements can be used to construct detailed three-dimensional representations of the environment.
According to the complaints, this technology can capture the contours and dimensions of a person's face and hands at close range.
The plaintiffs argue that facial measurements could be used to generate a faceprint and qualify as biometric identifiers under Illinois law. Whether the data collected by the robots meets the law's definition, and whether the companies violated the Act, remain unresolved.
The AI Training and Data-Sharing Allegations
The central concern is not just what the robots may capture, but how the resulting data may be used and shared. The two complaints raise related but distinct allegations about the companies' practices.
The complaint against Coco Robotics alleges that the company records detailed, 360-degree LiDAR data as its robots navigate urban environments. It also claims Coco has not specified that human faces and hands are blurred, reduced in detail or removed from the collected LiDAR data.
The complaint states that the company 'gives no notice before a robot records a person, identifies no specific purpose or retention period for the data, obtains no written release, and has published no retention or destruction schedule'.
It further alleges that Coco uses footage collected by its robots to train its own AI models and shares data with OpenAI to train the company's models. OpenAI is the creator of ChatGPT.
The alleged OpenAI connection raises questions about how robot-collected data may be used in AI development. However, the complaint does not establish that OpenAI received biometric identifiers from the robots or used them to identify individuals.
The lawsuit against Serve Robotics raises similar concerns about the commercial use of robot-collected data.
Serve fulfils food delivery orders through Uber Eats and Grubhub. Its complaint cites company disclosures to investors stating that its business model includes collecting and licensing video and LiDAR datasets to third parties for AI model training.
Unlike the complaint against Coco, the Serve lawsuit also highlights the collection of audio recordings by its robots.
Customers May Have Little Choice Over Robot Deliveries
The complaints argue that customers may have no meaningful opportunity to consent because delivery platforms can assign orders to robots without customers specifically requesting one. Customers must then approach the machine to retrieve their food or groceries.
The plaintiffs also argue that customers may have no direct account with the robotics company and may not know its data practices before the robot arrives.
This raises questions about how responsibility for data collection is communicated when a delivery platform, rather than the customer, determines how an order reaches the door. The plaintiffs argue that customers may be exposed to the robotics company's data-collection practices without a clear opportunity to consent or refuse.
What the Companies Say
Both companies have rejected the allegations. Coco Robotics said it had not collected biometric data in Chicago and argued that the lawsuit 'fundamentally misunderstands our technology'.
The company also said that 'the data we share is navigational data used to make sidewalks safer for all users'. It described the case as 'frivolous' and said it does not share data from the beginning and end of delivery runs.
Serve Robotics said it does not use the data to identify individuals and that its systems are 'not designed to identify individuals or create biometric profiles'.
The dispute centres on whether data collected for navigation and autonomous operation could also constitute protected biometric information. The companies' stated intentions do not, by themselves, resolve the plaintiffs' legal claims.
What Illinois' Biometric Privacy Law Requires
Illinois' Biometric Information Privacy Act gives individuals the right to sue companies over certain unlawful collection and use of biometric data.
Under the law, companies must inform people in writing about the biometric information being collected, explain the purpose and duration of its use, obtain written consent and establish a schedule for retaining and destroying the data. The law also restricts the sale of, or other profiting from, biometric identifiers.
The lawsuits seek statutory damages of $1,000 (£748) for negligent violations and $5,000 (£3,738) for intentional or reckless violations. The pound equivalents are approximate. These are amounts sought by the plaintiffs, not damages already awarded by a court; the amount recoverable would depend on the legal proceedings and the application of the law.
Both complaints say their proposed classes include many thousands of people. The cases were filed by the same Chicago law firm, Almeida Law Group.
Chicago residents had already raised concerns about delivery robots before the lawsuits were filed. A petition opposing the robots cited collisions, interference with emergency vehicles and potential surveillance. The petition had attracted more than 4,550 signatures at the time of the cited report.
The outcome may help clarify how Illinois' biometric privacy protections apply to delivery robots that collect information about customers and other people as they navigate public spaces.
