Chicago lawsuits accuse Coco and Serve delivery robots of unauthorized biometric scans

The lawsuits, reported by the Associated Press, claim the two men did not request robot delivery in the app, but robots from Coco and Serve arrived through DoorDash and Uber Eats, respectively. When the men unlocked the robots' cargo bays to retrieve their orders, the suits allege, cameras and LiDAR scanned their hands and faces without explicit prior consent. If proven, the allegations would put Coco and Serve in breach of BIPA, an Illinois privacy law enacted in 2008.

Both class-action complaints claim video and sensor data is retained by the robots in violation of privacy law and shared with AI companies for training purposes. The plaintiffs are seeking statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation.

Coco and Serve have denied the allegations. A Coco spokesperson told the AP the lawsuit 'fundamentally misunderstands our technology' and said the company has not collected biometric data in Chicago. Coco also called the legal action 'frivolous' and said the data it shares is navigational data used to make sidewalks safer for all users. Serve said it 'does not use data to identify individuals or create biometric profiles.'

The companies' privacy policies differ in detail. Coco's policy was last updated in 2022, before it began operating in Chicago, and is relatively light on data retention rules. It does mention sharing data with third parties and affiliates, though most of that appears to be aggregated and anonymized before use. Serve's policy has been updated more recently and says retention periods are determined by 'contractual obligations with our delivery partners.' It also mentions sharing information with unnamed 'service providers and vendors' and explicitly refers to sharing data 'to train AI agents and models.'

The defense put forward by the robot companies is that delivery robots cannot operate without scanning their environment to navigate sidewalks and avoid pedestrians. The central question in the litigation is whether the data collection at issue was done without permission and therefore contravenes the Illinois privacy act.

The filings come as privacy complaints involving Flock cameras, delivery drones, 'spy' glasses and similar technology continue. Some Reddit users have described delivery robots as 'mobile data thieves' and 'sidewalk surveillance,' according to TechRadar.