Serve Robotics and Coco Robotics Face BIPA Lawsuits Over Alleged Biometric Scanning by Delivery Robots

Autonomous food-delivery robots are designed to make ordering meals and groceries more convenient, but two new class-action lawsuits in Illinois are raising questions about how much personal information these machines may collect while navigating public sidewalks. The cases, Schain v. Serve Robotics and Breidinger v. Coco Robotics, allege that delivery robots operated by Serve Robotics and Coco Robotics captured measurements of people’s faces and hands without the notice and written consent required under Illinois law.

Filed in Cook County, Illinois, on October 9, 2026, the proposed class actions focus on the use of cameras and other sensors in sidewalk delivery robots. According to the complaints, the technology allegedly collected facial and hand geometry from customers retrieving deliveries and from other people who happened to pass near the machines. The plaintiffs further allege that the companies retained footage and sensor data for artificial intelligence training or shared certain information with third parties.

Both companies have disputed the allegations. Serve Robotics says its systems are designed to help robots navigate sidewalks safely and are not intended to identify individuals or create biometric profiles. Coco Robotics has also denied collecting biometric data in Chicago and says the claims misunderstand its technology. The courts have not determined whether either company violated Illinois law.

The lawsuits highlight a growing challenge for the technology industry: how to develop AI-powered services while protecting the privacy of people who may be recorded without realizing it.

What Are Schain v. Serve Robotics and Breidinger v. Coco Robotics?

The two lawsuits are separate legal actions brought by individuals who allege that delivery robots collected biometric information without their permission. Both cases invoke the Illinois Biometric Information Privacy Act, commonly known as BIPA, a state law that regulates the collection, storage, use, and disclosure of certain biometric identifiers and information.

The lawsuit against Serve Robotics is known as Schain v. Serve Robotics, Inc. The complaint against Coco Robotics is Breidinger v. Coco Robotics. Reports identify Barry Schain as the plaintiff in the Serve case and Mitchell Breidinger as the plaintiff in the Coco case.

The complaints describe similar concerns about how customers interact with delivery robots. When a robot arrives with an order, a person may need to approach its front-facing camera or sensor system, enter a code, and retrieve the items from its storage compartment. The plaintiffs allege that these interactions allow the machines to capture detailed measurements of their faces and hands.

The lawsuits also claim that the robots may record other people in their surroundings, including pedestrians who have no connection to the delivery. That aspect of the cases raises a broader question about privacy in public spaces: whether people should have to consider the possibility of biometric data collection simply because an autonomous machine passes nearby.

At this stage, the allegations remain unproven. The lawsuits seek to represent groups of potentially affected people, but a judge has not certified either proposed class. Filing a class-action complaint does not establish that the defendants broke the law.

How Delivery Robots Could Collect Facial and Hand Geometry

Autonomous delivery robots use cameras, sensors, and navigation software to move through streets and sidewalks, avoid obstacles, and locate delivery destinations. Some systems may combine visual information with measurements from other sensors to build an understanding of their surroundings.

One technology mentioned in the lawsuits is LiDAR, short for light detection and ranging. LiDAR sends out laser pulses and measures the returning signals to estimate distances and map nearby objects. It is commonly used in robotics and other systems that need to understand the physical environment.

The plaintiffs allege that the robots’ camera footage and sensor measurements captured detailed information about the shape and structure of people’s faces and hands. According to the complaints, these measurements could be processed into representations of facial or hand geometry, which the plaintiffs argue qualify as biometric identifiers under Illinois law.

The distinction between ordinary environmental sensing and biometric identification is central to the dispute. A robot may need to detect that a person is standing in front of it so it can stop safely or allow a delivery compartment to be opened. That function is not automatically the same as identifying the individual or creating a biometric profile.

The legal question is whether the particular data allegedly collected, the way it was processed, and the companies’ handling of that information fall within BIPA’s requirements. The answer may depend on the evidence, the systems actually used, and how the law applies to those systems.

The companies’ responses directly challenge the plaintiffs’ characterization of the technology. Serve says its robots do not use the data to identify individuals and are not designed to create biometric profiles. Coco has said it has not collected biometric data in Chicago and has disputed the description of its technology in the complaint.

What Is the Illinois Biometric Information Privacy Act?

Illinois enacted the Biometric Information Privacy Act in 2008. The law is designed to protect individuals when private entities collect or handle certain types of biometric identifiers, including fingerprints, voiceprints, and scans of hand or face geometry.

Unlike a password, a biometric characteristic cannot easily be replaced if it is compromised. That makes the collection and storage of biometric information particularly sensitive. A person can change a password after a security breach, but changing the underlying geometry of their face or hands is not a realistic option.

BIPA establishes requirements for covered businesses that collect or possess biometric identifiers or information. Depending on the circumstances, businesses may need to provide written notice explaining what information they collect and why, disclose how long it will be retained, obtain a written release before collection, and maintain a publicly available retention and destruction policy.

The law also places restrictions on disclosure and handling of protected biometric information. Its precise requirements depend on the type of information involved and the activity at issue.

In the delivery-robot cases, the plaintiffs argue that the companies failed to provide the required written notice and obtain consent before collecting biometric data. They also challenge the alleged retention and sharing of the information.

The companies’ denials mean the court will need to assess whether the systems collected information covered by BIPA and whether the companies’ practices violated any applicable requirements. The fact that a device has cameras or sensors does not, by itself, establish a BIPA violation.

What Does the Serve Robotics Lawsuit Allege?

In Schain v. Serve Robotics, Barry Schain alleges that Serve delivery robots recorded and measured his face and hands during deliveries in Chicago. According to reporting on the complaint, Schain received three deliveries involving Serve robots, with the most recent reportedly occurring on October 4, 2026, when an Uber Eats order was assigned to a robot.

The complaint alleges that Schain did not choose robot delivery and was not given the written notice or consent process that he says BIPA requires. It further claims that the robots’ cameras and LiDAR sensors captured information about his facial and hand geometry as he approached the machine to retrieve an order.

The lawsuit also raises concerns about what happened to the recorded material after collection. According to the allegations, Serve retained video and sensor data for AI training and potentially licensed datasets to third parties. The complaint argues that the company’s handling of this information violated Illinois’ biometric privacy requirements.

Serve has said that its robots use cameras and sensors to navigate Chicago sidewalks safely. The company also maintains that its systems are not designed to identify individuals or create biometric profiles and has said it will defend against the lawsuit.

That response is important because the case is not simply about whether a robot records video. It concerns whether the information allegedly captured and processed constitutes protected biometric data under BIPA, and whether the company complied with the law.

The court will need to evaluate the allegations against the relevant evidence, including how the robot’s sensors operate, what data is stored, how that data is used, and whether any required notices or permissions were provided.

What Does the Coco Robotics Lawsuit Allege?

The companion case, Breidinger v. Coco Robotics, centers on Mitchell Breidinger, a Chicago resident who alleges that a Coco robot collected biometric information when delivering groceries ordered through DoorDash.

According to reporting on the lawsuit, Breidinger says he ordered groceries in September 2025 but did not select robot delivery. His order was allegedly assigned to a Coco robot, requiring him to approach the machine, enter a code, and retrieve his groceries.

The complaint alleges that the robot’s cameras recorded his face, head, and hands while its sensors measured their geometry. It also alleges that a remote operator could view video from the delivery in real time. Breidinger claims he was not given the written disclosures or consent process required under BIPA.

The complaint raises additional questions about AI development and data sharing. It alleges that Coco retained robot-collected information for training AI models and shared information with OpenAI and other third parties. These are claims made in the lawsuit, not judicial findings about the companies’ data practices.

Coco has strongly disputed the allegations. The company has said it has not collected biometric data in Chicago and described the lawsuit as based on a misunderstanding of its technology. Coco has also stated that the information it shares is anonymous navigation data intended to improve sidewalk safety, and it has denied using LiDAR in Chicago.

Those statements contrast with the plaintiffs’ descriptions of the systems. The dispute may require a closer examination of the actual data collected, how it is processed, whether it can be linked to individuals, and what information, if any, is shared externally.

Why AI Training and Third-Party Data Sharing Matter

AI systems often improve through the analysis of large amounts of data. For autonomous robots, this may include images of sidewalks, road crossings, obstacles, pedestrians, and delivery environments. Such information can help developers train or evaluate navigation systems.

However, collecting information to improve a machine’s performance can raise privacy concerns when the data includes identifiable people. Images and sensor recordings may reveal more than the location of a nearby obstacle. Depending on how they are processed and retained, they may also contain details about a person’s appearance, movements, or other characteristics.

The lawsuits allege that data from the delivery robots was retained for AI training and, in the circumstances described by each complaint, shared or licensed to third parties. The plaintiffs argue that collecting and using biometric information in this way without the required consent violates BIPA.

The companies dispute the claim that their navigation systems collect biometric information as alleged. A key distinction is whether the data is used to recognize or identify a person, whether it is transformed into a biometric identifier, and whether the information is covered by the law regardless of the company’s stated purpose.

An additional issue is whether data described as anonymous can reasonably be connected to an individual. Removing a name from a dataset does not necessarily guarantee that a person cannot be identified, particularly if the information can be combined with delivery records, location data, or other details. Whether that concern applies to the data in these cases must be established through evidence rather than assumed.

The cases could therefore draw attention to how robotics companies document their data practices, explain sensor use, establish retention periods, and assess the privacy implications of AI training.

Who Could Be Affected by the Lawsuits?

The proposed class actions are aimed at groups of people in Illinois who received deliveries from the relevant companies’ robots and were allegedly recorded by their cameras or sensors. The complaints also discuss people who may have been captured while walking near the robots.

The proposed classes are not identical. The Serve case concerns qualifying deliveries made by Serve robots, while the Coco case concerns qualifying deliveries made by Coco robots. Reports describe the proposed groups in terms of people who received orders through services such as Uber Eats, DoorDash, Grubhub, or other third-party platforms and were recorded in Illinois.

Whether people who never ordered from a robot can be included may depend on the exact class definitions, the evidence, and the court’s interpretation of BIPA. The allegation that pedestrians were recorded does not automatically mean every passerby has a valid claim.

Neither case should be treated as an approved class action with a confirmed group of eligible claimants. Class certification is a separate legal step, and the court must decide whether the proposed cases meet the relevant requirements.

People who believe they may have been affected should look for reliable updates about the cases rather than assuming that they are entitled to compensation. As of the reporting cited for this article, there was no confirmed settlement or court-approved claims process.

What Damages Are the Plaintiffs Seeking?

The lawsuits reportedly seek statutory damages under BIPA, along with other relief, including court orders requiring compliance with the law and payment of legal fees and costs.

BIPA provides for statutory damages of $1,000 per violation for negligent violations and $5,000 per violation for intentional or reckless violations, as well as potential injunctive relief and other remedies allowed by the statute. The amounts sought in a complaint are not the same as damages that a court has awarded.

The number of alleged violations, the applicable legal standard, the scope of any class, and the ultimate availability of damages would all be matters for the legal process. No award should be assumed simply because a lawsuit has been filed.

The potential financial stakes help explain why businesses operating in Illinois pay close attention to BIPA. The law has generated litigation across several industries, particularly where companies use fingerprints, facial recognition, or other technologies that may involve biometric identifiers.

For robotics companies, the cases raise questions about whether privacy compliance needs to be built into the design and operation of machines that collect information from the public.

What the Lawsuits Could Mean for the Future of Delivery Robots

Autonomous delivery robots are becoming more visible in urban areas, where companies use them to transport meals, groceries, and other small orders. Supporters point to potential benefits such as convenient delivery, fewer short-distance vehicle trips, and new approaches to last-mile logistics. At the same time, the technology has prompted debate about sidewalk access, pedestrian safety, accountability, and the use of cameras in shared public spaces.

The BIPA lawsuits add biometric privacy to that discussion. If the plaintiffs can establish that the robots collected protected biometric information without the required notice or consent, the cases could influence how companies design data collection processes and explain their practices to customers.

Businesses may face pressure to clarify whether their sensors merely detect objects and obstacles or also generate information that could be considered biometric. They may also need to review data retention, access controls, third-party agreements, and how AI training datasets are created.

Even if the courts ultimately find that the specific systems at issue did not violate BIPA, the cases may encourage clearer communication about what delivery robots record and how that information is used. Consumers may increasingly expect companies to explain whether footage is stored, whether people can be identified, and whether data is shared with outside organizations.

The cases also demonstrate that privacy questions can arise even when people are not using a traditional app or directly interacting with a digital service. A pedestrian may simply be walking down a sidewalk when an autonomous device passes by. Whether existing laws adequately address that situation is likely to remain a topic of public and legal debate.

What Happens Next in Schain v. Serve Robotics and Breidinger v. Coco Robotics?

The next steps will depend on the court proceedings in Cook County. The defendants may challenge the complaints, dispute whether the alleged data qualifies as biometric information, or contest other legal and factual issues. The plaintiffs will need to support their claims through the legal process.

Class certification, if pursued, would determine whether the cases can proceed on behalf of a wider group of people rather than only the named plaintiffs. The court may also consider what evidence is needed to determine how the robots operate and how the companies collect, store, use, or share data.

At the time of the cited reports, both companies denied the core allegations, and no finding of liability had been made. The lawsuits should therefore be understood as active legal claims rather than proof that the companies unlawfully collected biometric information.

For now, the central question is whether camera and sensor data gathered by autonomous delivery robots crosses the line from ordinary navigation information into biometric information protected by Illinois law. The answer could have implications for robotics companies, AI developers, delivery platforms, and consumers concerned about privacy in public spaces.

Frequently Asked Questions

What are Schain v. Serve Robotics and Breidinger v. Coco Robotics?

They are proposed class-action lawsuits filed in Cook County, Illinois, on October 9, 2026. The plaintiffs allege that delivery robots operated by Serve Robotics and Coco Robotics collected facial and hand geometry without the notice and written consent required by Illinois’ Biometric Information Privacy Act.

Did the delivery robots illegally scan customers?

That has not been established. The plaintiffs allege that the robots captured biometric information without consent, while both companies deny the allegations or dispute that their systems collect biometric data as described. The courts have not ruled on liability.

What is BIPA?

The Illinois Biometric Information Privacy Act is a state law that regulates how private entities collect, retain, disclose, and handle certain biometric identifiers and information. Its requirements can include written notice, disclosure of the purpose and retention period, and written consent.

Did Serve Robotics and Coco Robotics use the data to train AI?

The complaints allege that data was retained for AI training and raise concerns about sharing with third parties. The companies dispute the allegations about biometric collection. The claims concerning the specific data practices remain unresolved.

Can pedestrians be included in the lawsuits?

The complaints allege that people walking near the robots may also have been recorded. Whether pedestrians can be included in a proposed class or establish a claim will depend on the legal requirements, evidence, and court decisions.

Is there a settlement or a claim form available?

The reporting cited for this article does not establish a settlement or court-approved claims process. Neither proposed class should be treated as certified. Readers should consult reliable case updates and legal counsel for guidance about their own circumstances.

Conclusion

The Schain v. Serve Robotics and Breidinger v. Coco Robotics lawsuits put a spotlight on the intersection of autonomous delivery technology, artificial intelligence, and biometric privacy. The plaintiffs claim that robots collected sensitive measurements of customers and pedestrians without proper consent, while the companies maintain that their technology is used for navigation and deny the central allegations.

The outcome will depend on evidence and judicial interpretation of Illinois law. Regardless of the final result, the cases raise an important question for the future of AI-powered services: how can companies use sensors to make autonomous machines safer and more capable while respecting the privacy rights of people who encounter them?

As delivery robots become more common, transparent data practices and clear legal standards may become increasingly important to public trust in the technology.

The Judge