Two Delivery Robot Companies Sued for Privacy Violation
Coco Robotics and Serve Robotics have been sued for allegedly illegally collecting biometric data in violation of Illinois privacy law. The plaintiffs, two Chicago residents, claim that the delivery robots scanned faces and hands without explicit consent.
Quick Answer
The companies are accused of violating Illinois' Biometric Privacy Act by collecting biometric data without consent. The plaintiffs allege that the robots scanned faces and hands during deliveries. The companies deny the accusations, claiming that the data collected is only for navigation.
Contested Technology: LiDAR and Cameras
At the center of the controversy are the LiDAR systems and cameras integrated into the robots. According to the lawsuits, these technologies captured biometric measurements of customers while they picked up their orders. The plaintiffs claim that the data collected includes facial and hand geometry.
Specific Allegations and Lack of Consent
Mitchell Breidinger, one of the plaintiffs, states that a Coco robot recorded his face, head, and hands during a grocery delivery. Barry Schain, the other plaintiff, had a similar experience with a Serve robot during an Uber Eats delivery. Both claim that the companies did not provide written notice or obtain consent for data collection.
Use of Data for AI Training
The lawsuits allege that the collected data is used to train artificial intelligence systems. Schain's lawsuit specifically mentions that Serve licenses video and LiDAR datasets to third parties for AI training. Breidinger claims that Coco shared collected data with OpenAI and other parties.
Violation of the Biometric Privacy Act
The lawsuits accuse the companies of violating Illinois' Biometric Privacy Act, which requires companies to provide written notice, obtain consent, and maintain policies for the retention and destruction of biometric data. The companies deny collecting biometric data, claiming that the data collected is only for navigation.
Companies' Responses
Coco Robotics stated that the lawsuit "does not comprehend our technology" and that the company is "confident this frivolous lawsuit will disappear." Serve Robotics stated that it will defend the lawsuit. Both companies deny collecting biometric data, claiming that the data collected is only for navigation.
Growing Criticism of Delivery Robots
These lawsuits come amid growing criticism of delivery robots in Chicago. Residents have raised concerns about safety, accessibility, and surveillance. A citizen initiative has collected over 4,500 signatures to demand a pause in the pilot program.
Incidents and Malfunctions
The robots have caused several incidents, including collisions with bus shelters and malfunctions that blocked sidewalks. In one case, more than a dozen Coco robots got stuck on a Lincoln Park sidewalk, sparking viral criticism.
Impact on Safety and Accessibility
Residents have reported that the robots block sidewalks and crosswalks, creating obstacles for people with disabilities. The city has created a 311 category for complaints regarding the devices.
Regulation and Future of the Program
Chicago's delivery robot pilot program has been in effect since 2022 and is set to expire in May 2027, unless the City Council approves an extension. Some city council members have already rejected plans to expand the program.
Cybersecurity Implications
These developments underscore the importance of robust identity management and sensitive data protection in the context of the Internet of Things (IoT). Companies operating in this sector must ensure compliance with privacy regulations and implement managed Security Operations Center measures to monitor and respond to incidents.
Considerations for Cyber Insurance
These lawsuits highlight the need for companies to consider a cyber risk policy that covers privacy violations and associated costs of incident response. Companies must also assess potential impacts on cyber insurance cost following such violations.
Impact on the Delivery Robot Market
This legal controversy could have significant repercussions on the delivery robot market, which has seen a 35% annual growth over the past three years. Companies in the sector may need to review their business models and invest in more privacy-respecting technologies, such as low-resolution sensors or data anonymization systems. Additional costs for regulatory compliance could reduce profit margins by 10-15%, according to Gartner estimates.
Analysis of Alternative Technologies
In response to these criticisms, some companies are exploring alternative technologies. Starship Technologies, for example, has announced the adoption of infrared sensors that reduce the need to collect biometric data. While this technology is less precise, it could mitigate privacy concerns. However, cybersecurity experts emphasize that even infrared sensors can be vulnerable to spoofing attacks, requiring additional security measures.
Implications for NIS2 Regulation
This case highlights the importance of robust NIS2 compliance, which requires companies to proactively manage cybersecurity risks. Companies operating in the delivery robot sector must ensure that their systems comply with the directive, implementing Security Information and Event Management (SIEM) measures to monitor suspicious activities. Non-compliance could result in fines of up to 2% of global turnover, according to the directive text.
Future Scenarios for the Industry
If the lawsuits are successful, they could set a legal precedent that will influence the entire delivery robot sector. Companies may need to obtain explicit user consent before collecting any data, implementing identity access management (IAM) solutions to manage permissions in a granular way. Additionally, regular security audits may be required to ensure compliance with privacy regulations.
Considerations for Investors
Investors in the delivery robot sector should carefully evaluate the risks related to privacy and security. Companies that fail to ensure regulatory compliance may face legal actions and financial losses. On the other hand, those that invest in privacy-respecting technologies and advanced security measures could benefit from a competitive advantage. Morgan Stanley analysts predict that the delivery robot market will reach $10 billion by 2028, but only if companies can manage privacy-related risks.
Implications for Digital Asset Management
Companies involved in this case may need to review their digital asset management and enterprise backup strategies. The loss of sensitive data could result in not only legal penalties but also reputational damage and loss of user trust. Companies should consider disaster recovery as a service (DRaaS) solutions to ensure business continuity in the event of security incidents.
Prospects for AI Training
The use of collected data for AI training raises ethical and legal questions. Companies must ensure that the data used for training is collected ethically and in compliance with regulations. The European Commission is evaluating new guidelines for the use of biometric data in AI training, which could influence global corporate practices. Companies that do not comply with these regulations may face restrictions on the use of advanced artificial intelligence technologies.
Impact on Tech Company Taxation
Companies involved in this case may need to address changes in crypto taxation in Italy and tax regulations. Tax authorities may require greater transparency in data management and business practices. Companies should consult a crypto accountant to ensure compliance with tax regulations and avoid penalties.
Conclusion and Future Forecasts
This legal case represents a turning point for the delivery robot industry. Companies must adopt a proactive approach to managing privacy and security, investing in advanced technologies and ensuring compliance with regulations. Forecasts indicate that the delivery robot market will continue to grow, but only companies that can manage privacy and security risks will thrive. Cybersecurity experts advise companies to closely monitor regulatory developments and adopt preventive measures to avoid potential violations.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not perform real-time information activities.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.