McDonald's allegedly violated Illinois' Biometric Information Privacy Act by collecting customers' voice recordings through its AI-powered drive-thru ordering system without obtaining written consent, leading to a class-action lawsuit seeking damages up to $5,000 per violation.
McDonald's deployed an AI-powered voice recognition system called Apprente (now McD Tech Labs) at 10 Chicago-area restaurants starting in 2019 to automate drive-thru order taking. The system has an 85% accuracy rate and processes voice data to identify customers and predict demographic information including age, gender, accent, nationality, and national origin. In April 2021, Shannon Carpenter filed a class-action lawsuit against McDonald's claiming the company violated Illinois' Biometric Information Privacy Act (BIPA) by collecting customers' voiceprint biometrics without written consent. The lawsuit alleges McDonald's failed to inform customers about data collection, explain how voice data is stored or deleted, or obtain required written consent. The AI system reportedly combines voice recognition with license plate scanning to identify repeat customers across locations and provide tailored experiences. Under BIPA, violations can result in damages of up to $5,000 per intentional violation or $1,000 for negligent violations. The lawsuit estimates thousands of affected customers, potentially resulting in damages exceeding $5 million before attorney fees.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed