On October 9, 2026, two Chicago residents filed separate proposed class actions in the Circuit Court of Cook County under Illinois' Biometric Information Privacy Act (BIPA). Mitchell Breidinger is suing Coco Robotics, whose operating entity is Cyan Robotics. Barry Schain is suing Serve Robotics; ClassAction.org lists that case as No. 2026CH09784. Both say a delivery app (DoorDash for Breidinger, Uber Eats for Schain) assigned a sidewalk robot to their orders without their choosing it. They allege the robots' cameras and LiDAR recorded the geometry of their faces and hands while they unlocked the cargo bay, that the data was stored with their names and addresses, and that it was shared with third parties, including for AI training. BIPA provides $1,000 per negligent violation and $5,000 per intentional or reckless violation.
This matters beyond two startups. Any camera-equipped robot, vehicle or wearable that operates in Illinois and feeds a data-licensing or model-training pipeline faces the same question: does incidental sensor capture, linked to a customer's identity, amount to a "scan of face or hand geometry"? The plaintiffs' theory joins two facts. The companies openly say they monetize sensor data, and delivery platforms give them each recipient's identity.
What we checked
- What do the filed complaints and the companies' published policies establish about biometric collection, retention, identification, and any licensing of sensor data? partly confirmed. Reporting on the complaints confirms they allege camera and LiDAR face and hand geometry linked to names and addresses, no published retention schedule, and sharing with third parties for AI training. None of this is proven. Serve's FY2025 10-K confirms a 'video and LiDAR licensing model' for third-party AI training. Reporting from 2025 says OpenAI gets access to Coco's robot data. Neither company's policy acknowledges biometric collection, and neither states a retention period for robot footage. [1][5][7][6][8]
- Do the companies' public disclosures support the data-licensing and AI-training allegations? (added) confirmed. Serve's 10-K describes licensing video and LiDAR datasets to third-party AI companies, and its current privacy notice lists 'To train artificial intelligence agents and models' as a purpose for robot data. TechCrunch reported that under Coco's 2025 OpenAI deal, OpenAI 'gains the real-world data the robots collect to train its models.' [5][6][8][9]
What we found
- The core allegations are reported consistently across outlets. LiDAR allegedly measured 3D face and hand geometry (distances to the nose, brow and chin), which the complaint calls 'established means of identifying a person,' and stored it with recipients' names and addresses. The Coco complaint names OpenAI as a recipient. The Serve complaint says third parties 'processed Mr. Schain's biometric identifiers for their own purposes.' Counsel for both plaintiffs are David Almeida and Lucas Coughlin. [1][2][3]
- Both companies deny the biometric claims. Coco's Carl Hansen said the suit 'fundamentally misunderstands our technology, we have not collected biometric data in Chicago.' Coco also told the Chicago Tribune that it has 'never used LiDAR in Chicago,' that it shares only navigational data (for example, hazard data for the BlindSquare app), and that it had not yet been served. Serve said its systems 'are not designed to identify individuals or create biometric profiles' and that it will defend the case. [1][4]
- Serve's FY2025 Form 10-K describes a new 'video and LiDAR licensing model' for third-party AI companies and calls it unproven. It warns that privacy laws, explicitly including BIPA, and rules on 'biometric identifiers' and 'bystander recordings' could restrict its ability to 'collect, process, and license video and LiDAR datasets.' In the portions reviewed, the filing does not mention face blurring or de-identification. [5]
- Serve's privacy notice, dated October 19, 2026 (ten days after the suit was filed), lists video from robot cameras and audio recordings for 'environmental monitoring,' plus 'To train artificial intelligence agents and models' as a purpose for robot data. It gives no fixed retention period and does not mention LiDAR. Its Australian addendum says Serve does not seek to identify people and does not use facial recognition. An Illinois-specific biometric section is absent. Earlier versions of the notice are not available, so what changed is unknown. [6]
- Coco's privacy policy, operated under Cyan Robotics, still carries a 'Last Updated: May 19, 2022' date, which predates its Chicago launch in November 2024. It says robots carry multiple cameras whose footage a remote pilot views in real time and may review later. It states no retention period, never uses the word 'biometric,' does not mention LiDAR or AI training, and has no Illinois section. It permits sharing of de-identified or aggregated data with third parties. [7][4]
- Coco's data flows to OpenAI are on the public record, though the specific contents are not. TechCrunch reported that Coco's March 2025 deal 'allows Coco to use OpenAI while the AI company gains the real-world data the robots collect to train its models.' In October 2025, CEO Zach Rash said Coco has 'millions of miles of data' and no plans to sell it to peers. [8][9]
What it means
For builders, the main exposure is not facial recognition. It is the combination of three things: raw imagery or 3D sensor data, an identity linked to it (a name, an address or an order record), and a licensing or training pipeline that sends it to third parties. Serve's own 10-K treats this as a BIPA risk. Neither company's public policy shows a BIPA-style written notice, a written release, or a published retention and destruction schedule. Those are the requirements most often litigated, and they are relatively easy to plead. It remains unresolved whether navigation-grade camera and LiDAR data, never turned into templates, counts as a 'scan of face geometry.' But being 'not designed to identify individuals' is a merits defense, not a compliance program.
If you run sensors in public spaces or train on fleet data, three steps help. First, write a sensor-specific retention and destruction schedule and publish it. Second, blur or strip faces and hands at the edge before storage or licensing, and log that you did. Third, keep delivery or order identity separate from perception data. For Illinois, get BIPA-compliant consent at the customer touchpoint, such as the delivery app or the unlock step, or document why your data falls outside the statute. Partners that assign robots by default, like the delivery platforms here, may also find themselves in the consent chain.
Still open
- Complaint text could not be parsed. Does the Serve complaint quote specific SEC language, and what evidence does the Coco complaint cite for LiDAR use and the OpenAI transfer?
- Do Coco's Chicago robots carry LiDAR at all, given Coco's denial and the complaint's claim?
- What did Serve change in its October 19, 2026 privacy notice, and what did earlier versions say?
- Has either company been served, removed the case to federal court, or moved to dismiss?