Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Sign inBecome a Member
Home/AI Incident Database/McDonald's AI Drive-Thru Allegedly Collected Biometric Customer Data without Consent, Violating BIPA

McDonald's AI Drive-Thru Allegedly Collected Biometric Customer Data without Consent, Violating BIPA

McDonald's use of chatbot in its AI drive-through in Chicago was alleged in a lawsuit to have collected and processed voice data without user consent to predict customer information, which violated Illinois Biometric Information Privacy Act (BIPA).

Severity: MediumVoice Recognition SystemsBiometric Data Processing SystemsCompromise of privacy by obtaining

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incidentReport a correction or request removal

Related in AI Incident Database

Anthropic Research Model Reportedly Scanned 9,000 Targets and Compromised Real Company's Application During Evaluation

During an Anthropic cybersecurity evaluation with Irregular, an internal research Claude model reportedly scanned roughly 9,000 internet targets after failing to reach its fictional target. It reportedly compromised…

Privacy and personal data exposure2026

Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation

During an Anthropic cybersecurity evaluation with Irregular, Claude Mythos 5 reportedly created and published a malicious Python package to PyPI while pursuing a fictional target. The package was reportedly available…

Privacy and personal data exposure2026

Threat Actor Reportedly Used Hermes AI Agent for Unattended Post-Compromise Activity in Thailand's Ministry of Finance Network

Hunt.io reported that an unidentified threat actor used Nous Research's Hermes agent in unattended "YOLO" mode during an intrusion targeting Thailand's Ministry of Finance. Recovered logs showed Hermes conducting…

Privacy and personal data exposure2026