This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A lawsuit was filed against a major fast-food corporation alleging that its AI-powered drive-thru voice ordering system, acquired from Apprente, collected customer biometric voice data without obtaining the required written consent under the Illinois Biometric Information Privacy Act (BIPA). The system allegedly processes audio to identify repeat customers and predict personal attributes such as age, gender, and nationality. The plaintiff seeks class-action status, citing potential damages exceeding $5 million.
McDonald's use of chatbot in its AI drive-through in Chicago was alleged in a lawsuit to have collected and processed voice data without user consent to predict customer information, which violated Illinois Biometric Information Privacy Act (BIPA).
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The AI system collected and processed customers' biometric voiceprints and inferred sensitive personal attributes without their consent, directly violating privacy regulations.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk was caused by the human decision to deploy the AI voice-recognition system without obtaining prior written consent from customers as required by law.
A class-action lawsuit alleging that McDonald's used an AI voice assistant to collect customer biometric data without consent in violation of Illinois privacy law. The incident is a commercial regulatory compliance issue with negligible implications for national security.
The AI system acts as a voice assistant to take customer orders at drive-thrus, augmenting the restaurant's capabilities while still requiring human workers to step in for about 20% of the orders.
Limited Risk: The system is an AI-powered chatbot interacting directly with natural persons, which carries transparency obligations to ensure users are aware they are interacting with an AI.
The primary function of the Apprente AI system is to act as a voice assistant to take customer orders at drive-thrus, utilizing voice recognition to process the audio.
The reports provide consistent and detailed information regarding the lawsuit, the specific AI technology (Apprente), the locations involved, and the legal basis under BIPA.
None
Technology
Advanced Voice Analysis
Software extracts demographic traits and biometric voiceprints from audio.
License Plate Integration
System links voiceprints with license plates to track repeat customers.
Data Inputs
Unconsented Voiceprints
Customer voice recordings collected and processed without written consent.
Lack of Data Transparency
No clear information on where biometric voice data is stored or deleted.
Human Factors
Lack of Customer Awareness
Customers did not know their biometric voiceprints were being harvested.
Process and Methods
Flawed Consent Process
Drive-thru process failed to obtain written consent before taking orders.
Inadequate Privacy Policies
Privacy policies failed to disclose biometric storage and deletion details.
Management
Focus on Labor Savings
Management prioritized automation and cost reduction over privacy compliance.
Inadequate Legal Risk Review
Failed to assess BIPA compliance before deploying voice AI in Illinois.
Regulatory Environment
Strict Biometric Laws
Illinois BIPA mandates strict written consent for biometric data collection.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
