McDonald's AI Drive-Thru Allegedly Collected Biometric Customer Data without Consent, Violating BIPA

McDonald's use of chatbot in its AI drive-through in Chicago was alleged in a lawsuit to have collected and processed voice data without user consent to predict customer information, which violated Illinois Biometric Information Privacy Act (BIPA).

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The AI system collected and processed customers' biometric voiceprints and inferred sensitive personal attributes without their consent, directly violating privacy regulations.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy risk was caused by the human decision to deploy the AI voice-recognition system without obtaining prior written consent from customers as required by law.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an AI-powered chatbot interacting directly with natural persons, which carries transparency obligations to ensure users are aware they are interacting with an AI.

AI system and alleged parties

• AI system: Apprente
• AI purpose: AI Voice Assistant; Voice Recognition
• Behaviour type: Assistant
• Alleged developer: McD Tech Labs, Apprente
• Alleged deployer: McDonald's
• Alleged harmed parties: Shannon Carpenter, McDonald's customers residing in Illinois, McDonald's customers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The reports explicitly describe privacy violations, alleging that McDonald's collected and processed customers' biometric voiceprints without their written consent.

Directly caused: The AI system directly collected and processed the voiceprints of Shannon Carpenter and thousands of other customers without obtaining prior written consent as required by Illinois law.

Inferred additional harm: It is highly likely that thousands of other customers who used the AI drive-thrus had their biometric voice data collected, stored, and analyzed without their knowledge or consent.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1000

Potential causes

Management

• Focus on Labor Savings: Management prioritized automation and cost reduction over privacy compliance.
• Inadequate Legal Risk Review: Failed to assess BIPA compliance before deploying voice AI in Illinois.

Technology

• Advanced Voice Analysis: Software extracts demographic traits and biometric voiceprints from audio.
• License Plate Integration: System links voiceprints with license plates to track repeat customers.

Data Inputs

• Unconsented Voiceprints: Customer voice recordings collected and processed without written consent.
• Lack of Data Transparency: No clear information on where biometric voice data is stored or deleted.

Human Factors

• Lack of Customer Awareness: Customers did not know their biometric voiceprints were being harvested.

Process and Methods

• Flawed Consent Process: Drive-thru process failed to obtain written consent before taking orders.
• Inadequate Privacy Policies: Privacy policies failed to disclose biometric storage and deletion details.

Regulatory Environment

• Strict Biometric Laws: Illinois BIPA mandates strict written consent for biometric data collection.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent and detailed information regarding the lawsuit, the specific AI technology (Apprente), the locations involved, and the legal basis under BIPA.
• Ambiguities identified: The exact number of customers whose voiceprints were collected is not specified, only described as 'thousands'.

A class-action lawsuit alleging that McDonald's used an AI voice assistant to collect customer biometric data without consent in violation of Illinois privacy law. The incident is a commercial regulatory compliance issue with negligible implications for national security.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: McDonald's

Threat characteristics

• Imminence: Long-term. The incident is a past deployment subject to ongoing civil litigation, representing no immediate or near-term national security crisis.
• Autonomy: Human-supervised. The system autonomously processed voice data to take orders and infer attributes, though human workers remained available to intervene.
• Novelty: Established threat. Commercial data collection disputes and class-action lawsuits under the Illinois Biometric Information Privacy Act are well-established legal issues.

Impact by dimension

• Physical security: Negligible. No physical threats, kinetic attacks, or critical infrastructure impacts were reported in connection with this commercial drive-thru system.
• Information security: Negligible. No indication of intelligence compromise, classified data theft, or state-sponsored information warfare operations.
• Sovereignty: Negligible. No threat to state authority, electoral processes, or core government functions; the incident is a corporate regulatory compliance issue.
• Economic security: Negligible. The incident involves potential corporate legal liabilities under state law, but poses no threat to national economic stability or strategic technology.
• Societal stability: Negligible. While the incident involves unauthorized biometric data collection of thousands of customers, it is a localized commercial privacy dispute handled through standard civil litigation.