Chicago lawsuits say Coco and Serve delivery robots scanned customers' faces without consent

What the lawsuits claim

Two Chicago residents have sued the companies behind the city's sidewalk food delivery robots, claiming the machines captured the geometry of their faces and hands without the notice and written consent Illinois law requires. The proposed class actions against Coco Robotics and Serve Robotics were filed separately in the Circuit Court of Cook County on 9 October 2026. ABC7 and CBS News Chicago reported them on 15 October, followed by the Chicago Sun-Times and WBEZ and Block Club Chicago on 16 October.

Mitchell Breidinger, who lives on the Near North Side, says he ordered groceries through DoorDash in September 2025 and never chose robot delivery, but the order was assigned to a Coco robot. To collect it, he had to stand close to the machine and enter a code. Barry Schain, a Lincoln Park resident, says he has received three deliveries from Serve robots, most recently on 4 October 2026, when an Uber Eats order he had not routed to a robot was assigned to one.

Both suits seek to represent Illinois customers whose orders were delivered by the companies' robots. They ask for statutory damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless one, an order requiring the companies to comply with the law, and attorneys' fees. The complaints themselves have not been published, and case numbers had not been reported when AI Lookout checked on 21 October; the details below come from the news reports that reviewed the filings.

How the robots allegedly capture faces and hands

According to the reports, the complaints say the robots' cameras and LiDAR, a sensor that measures distance with laser pulses, record three-dimensional measurements of a customer's face and hands as the person walks up to unlock the compartment and take the food. Breidinger's complaint says the Coco robot recorded his face, head and hands, that its LiDAR measured their geometry, and that a remote operator watched the delivery on live video.

The plaintiffs also say the robots scan the faces, hands and bodies of other people they pass on Chicago sidewalks, not only customers. They allege the measurements are stored alongside customers' names and addresses from the delivery apps, which would link the data to identifiable people. Neither man says he received a written notice about biometric collection, an explanation of how long data would be kept, or a consent form.

Those are allegations. No court has ruled on them, and the reports do not describe any technical evidence, such as a teardown or a data request, showing that face geometry was actually extracted from the sensor data rather than simply recorded as video.

What Coco and Serve say

Both companies deny collecting biometric data. "This lawsuit fundamentally misunderstands our technology," Coco's head of government relations, Carl Hansen, said in a statement. "We have not collected biometric data in Chicago, and thus have never shared it with any third-parties." Coco told ABC7 Chicago that it has "never used LiDAR in Chicago", that the data it shares is anonymous navigational data, and that it never shares video from the beginning or end of a trip. As an example, it said it provides real-time sidewalk hazard information to BlindSquare, a navigation app for people who are blind or have low vision.

A Serve spokesperson said the company was aware of the complaint and "will defend against it". Its robots use cameras and sensors to navigate the sidewalks safely, the spokesperson said, adding: "Serve does not use that data to identify individuals and our systems are not designed to identify individuals or create biometric profiles."

That distinction is likely to be central. Delivery robots need cameras to drive, and teleoperators need video when a robot gets stuck. The legal question is whether the companies go further and create or keep measurements of face or hand geometry, which is what Illinois regulates.

What Illinois biometric law requires

The Biometric Information Privacy Act, passed in 2008, defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. The same section says photographs are not biometric identifiers, which is why the suits focus on geometry measurements rather than on the robots simply filming people.

Before collecting such data, a company must tell the person in writing that it is being collected, state the specific purpose and how long it will be kept, and get a signed written release, which can be an electronic signature. It must publish a retention and destruction policy, may not sell or otherwise profit from the data, and may not disclose it without consent. Anyone aggrieved can sue in state court for $1,000 per negligent violation or $5,000 per intentional or reckless one.

Those per-violation amounts are why BIPA has produced some of the largest privacy settlements in the United States. An amendment that took effect on 2 August 2024 narrowed them: repeated collection of the same identifier from the same person by the same method now counts as a single violation, with at most one recovery per person. For a customer who met a robot three times, as Schain says he did, that limits the possible award, although a large class could still add up.

The AI training data question

The suits tie the alleged collection to artificial intelligence. Both say the companies keep video and sensor data to train AI systems. Schain's complaint points to Serve's own statements about licensing video and LiDAR datasets to third parties. Serve's quarterly report for the period ended 31 March 2026 lists "the unproven nature of our video and LiDAR licensing model" among its risks, and warns that "evolving privacy, data protection, and AI regulation" may restrict its ability to "collect, process, and license video and LiDAR datasets". The same filing names the Illinois Biometric Information Privacy Act among the privacy laws it has to comply with.

Breidinger's complaint says Coco has shared robot-collected data with OpenAI and other third parties. Coco and OpenAI announced a research collaboration in March 2025 under which Coco said it would share insights from more than half a million remotely monitored and piloted deliveries and integrate OpenAI models into its robotics stack for path planning and obstacle avoidance. Coco says the data it shares is navigational and that it has never shared biometric data. OpenAI is not a defendant, and the reports do not say it was asked to comment.

The case is one more fight over how AI companies gather training data from the physical world. Book buyers in Korea have faced questions over bulk orders suspected of feeding AI training, and face-search firms such as Clearview have spent years in court over scraped images, as in its appeal against a UK privacy fine.

A pilot program already under pressure

Chicago's personal delivery device pilot was introduced under former Mayor Lori Lightfoot in 2022. Coco was licensed by the city's Department of Business Affairs and Consumer Protection in November 2024, and Serve started in September 2025, according to CBS News Chicago. The program is run with the Chicago Department of Transportation and expires in May 2027 unless the City Council extends or ends it.

The robots were already contentious. Lincoln Park resident Josh Robertson started a petition asking the city to pause the program until it releases safety and accessibility data and sets clearer rules; he told CBS it has more than 4,600 signatures, some citing privacy. In February, Alderperson Daniel La Spata rejected plans to expand robots across much of the 1st Ward after more than 83 percent of residents who answered an online survey strongly opposed it. In March, a Serve robot broke the glass of a CTA bus shelter in West Town, and days later a Coco robot hit another shelter in Old Town.

Similar tensions have surfaced elsewhere. In Philadelphia, police arrested a retired professor for blocking an Uber Eats robot, a case that raised questions about how robots and pedestrians share sidewalks.

What happens next, and what is still unknown

The companies are expected to respond in court. In AI Lookout's reading, either could try to move the cases to federal court or seek dismissal by arguing that navigation video is not a scan of face or hand geometry. Delivery apps such as DoorDash and Uber Eats, which assign orders to robots, are not named as defendants in the reports.

Important facts are still missing: the case numbers, the full complaints, how many Illinois customers the proposed classes might cover, and any technical evidence about what the robots store. Nor is it clear whether Chicago will add privacy rules to the pilot before it is renewed in 2027. AI Lookout will update this article when the filings or the companies' responses become public.