Delivery Robots Sued for Illicit Biometric Scans in Chicago

Unsolicited sidewalk surveillance at the doorstep

Customers claim they never asked for automated deliveries in the first place.

According to filings reported by the Associated Press, the two plaintiffs placed ordinary takeout orders via DoorDash and Uber Eats, only to find autonomous rovers arriving at their doors instead of human couriers. The legal dispute started when customers stepped up to the machines to retrieve their meals.

The complaints allege that as customers opened the cargo compartments to grab their food, onboard sensor suites—combining optical cameras and LiDAR—scanned their faces and hands without explicit prior consent. Under the Illinois Biometric Information Privacy Act (BIPA), capturing such identifiers without written consent and published retention schedules is strictly illegal.

The lawsuits further contend that these video feeds and sensor point clouds were not merely processed in real time for sidewalk navigation. Instead, the filings claim the companies retained the recordings and handed them over to third-party artificial intelligence developers for model training.

Hefty BIPA penalties and vendor denials

Illinois enforces the strictest biometric privacy regime in the United States, allowing private citizens to sue directly for statutory damages: $1,000 for negligent violations and up to $5,000 for intentional or reckless conduct. Given the sheer volume of daily takeout runs across metro areas, accumulated penalties under BIPA can rapidly threaten entire business models.

Both robotics firms pushed back against the accusations. Coco Robotics labeled the litigation frivolous, while Serve Robotics stated it does not use sensor data to identify individuals or construct biometric profiles. Even so, the controversy echoes wider friction as autonomous systems ingest real-world data without clear boundaries—a tension highlighted when researchers saw how an isolated hacker used AI agents to breach over 100 corporate sites by exploiting loosely monitored automated inputs.

A review of Coco's public privacy policy shows it has not seen substantial revisions since 2022, well before its Chicago rollout. Serve's documentation acknowledges sharing information with service providers and partners based on contractual obligations, leaving significant ambiguity around how long raw sensory footage persists on remote servers.

What it means for delivery customers

Sidewalk delivery rovers are expanding rapidly across select urban zones in the US, including Chicago, Los Angeles, and university campuses. In most rollouts, delivery platforms like Uber Eats dispatch automated bots based on proximity and route viability without requiring customers to manually opt in.

If the Illinois litigation succeeds, platforms may be forced to introduce mandatory consent toggles before dispatching autonomous rovers to customer homes, or disable recording equipment entirely within residential drop-off zones.

As automated couriers multiply on public walkways, the boundary between obstacle avoidance and unauthorized surveillance will remain under intense legal scrutiny across US cities.