Lawsuits claim delivery robots recorded biometric data without permission

Two new Chicago lawsuits claim unauthorized biometric data collections In these cases, the biometrics are face and body scans Coco Robotics and Serve Robotics have denied the allegations The backlash to what's perceived as surveillance technology continues, with two Chicago residents taking robot delivery companies to court over the alleged collection of biometric data while dropping off food and groceries.

As the Associated Press reports, the two men bringing the cases claim that robots from Coco Robotics and Serve Robotics turned up — via DoorDash and Uber Eats respectively — even though robot delivery hadn't been requested in the app.

The key allegation is that when these individuals were unlocking the robot cargo bay to get their orders, their hands and faces were scanned via camera and LiDAR technology, without explicit prior permission.

If true, that would put Coco and Serve in breach of the Illinois Biometric Information Privacy Act (BIPA) of 2008.

Both class-action lawsuits claim that video and sensor data is being retained by these bots in violation of privacy law, and shared with AI companies for training purposes.

Statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation are being claimed through the courts.

Both Coco Robotics and Serve Robotics have denied the allegations.

We've reached out to both companies and will update this story if we hear back, but the AP reports Coco as saying the legal action is "frivolous", while Serve says it "does not use data to identify individuals or create biometric profiles". 'Fundamentally misunderstands our technology' A Serve delivery robot (Image credit: Serve Robotics) The Coco Robotics privacy policy — last updated in 2022, before it started operating in Chicago — is a little light on data retention policies, but does mention sharing data with third parties and affiliates, though most of this seems to be aggregated and anonymized before it's used.

As for the Serve Robotics privacy policy , it's been updated much more recently.

It says data retention periods are determined by "contractual obligations with our delivery partners", and there's the standard vagueness about sharing information with unnamed "service providers and vendors" on occasion.

There's also an explicit mention of sharing data "to train AI agents and models".

It's obviously impossible for a delivery robot to work without scanning its environment and navigating around sidewalks and pedestrians, and that's the defense being put forward here.

The crux of the case will be whether the data collection involved was done without permission, and contravenes the Illinois privacy act.