Character.AI's bankruptcy sale and the handling of user chats

Character Technologies, the company that runs the chatbot platform Character.AI, filed for Chapter 11 in the US Bankruptcy Court in Delaware on 12 October (a procedure under Chapter 11 of the US Bankruptcy Code in which a company deals with its debts under court supervision and may sell assets), and according to Implicator it plans to sell all or most of its assets. On 27 October the U.S. Trustee, the Justice Department official who oversees bankruptcy cases, filed an objection asking for a consumer privacy ombudsman to advise the court on which data can be sold and on what terms. As of 2 November, whether users' data and conversations will be sold with the assets had not been decided, and anyone with an account and chats stored with the company may be affected wherever they live (our inference from the worldwide user figure cited in the filing).

According to The Record's account of 30 October, the U.S. Trustee's filing cites about 12 million monthly active users worldwide, who spend about two hours a day on the platform on average. When users ask the chatbot whether their conversations are private, its reply is that nothing is shared without explicit permission. In the filing, the U.S. Trustee calls the privacy policy "opaque", and according to its description the policy cautions in places that the company may disclose personally identifiable information, and also permits that information to be transferred if the company is sold.

According to the filing, the policy was updated on 1 July 2026, while the company was "actively seeking to sell its assets". The U.S. Trustee asked the company to account for earlier versions of the policy, including whether each disclosed that personal information could be transferred in a sale, and how changes were communicated to users. According to the same report, the court has the power to restrict the sale of user data, under conditions set out in the first paragraph of the Perspective section.

According to PPC Land, the attorneys general of 39 states and Washington, D.C. filed a joint brief on 29 October adopting the U.S. Trustee's objection in full. In the brief, the states argue that a privacy ombudsman is needed wherever the property being sold may contain personal or sensitive information about users, including minors. The states also wrote that they are investigating the company over possible consumer protection and privacy violations based on the platform, and that the company's sale motion does not make clear whether it intends to sell the whole platform in addition to the Disney licence.

As of 2 November, the stalking horse bidder (the party that bids first, so that other buyers can bid above it) was Disney. According to PPC Land, Disney offered $20 million for a non-exclusive, perpetual licence to some of the company's intellectual property, a licence that excludes the app, the brand, and user data and conversations. Also according to PPC Land, the company wrote in its reply of 27 October that Disney is not purchasing personally identifiable information.

According to Implicator's report of 14 October, the company had not said at that point whether users' conversations were among the assets for sale, and the platform will shut down if no buyer is willing to keep it running. As quoted by Straight Arrow News, the company wrote in its bankruptcy announcement that user data "continues to be protected under our Privacy Policy".

According to the summary in front of MLex's paywall, the judge did not require the company to engage a privacy ombudsman at the 30 October hearing, but "strongly encourage[d]" it to consider doing so. Under the proposed timeline compiled by PPC Land, bids are due on 20 November, followed by an auction on 23 November and a sale hearing on 24 November. As of 2 November, we had not found whether the bidding procedures were approved or whether an ombudsman had been appointed.

Perspective

Under section 363(b)(1) of Title 11 of the US Code (the Bankruptcy Code), the sale of personally identifiable information is restricted when the privacy policy in effect on the day the case was filed prohibits transferring such information to unaffiliated parties. When that condition is met, the sale has to be consistent with the policy. A sale that is not consistent requires an ombudsman appointed under section 332, and the court can approve it only after notice and a hearing. Under section 332, the court orders the U.S. Trustee to appoint a disinterested person at least seven days before the hearing, to advise the court on the privacy losses or gains for consumers and on alternatives that would mitigate the losses (according to The Record's report of June 2025, the 23andMe bankruptcy sale also had such an ombudsman).

In its reply of 27 October, the company argued that the policy in effect on the filing date permits the sale and transfer of user data in this case, so no ombudsman is required (as quoted by PPC Land). According to The Record, the U.S. Trustee instead described the policy in the filing as "ambiguous" and pressed for the earlier versions and the 1 July update. The version we obtained is the one dated 27 August 2025, saved by the Internet Archive on 13 June 2026, under whose "Business Transfers" clause the company "may disclose certain information" in connection with a merger, sale of company assets or acquisition. We did not obtain the full text of the 1 July version and cannot compare whether the wording changed.

In the filing, the U.S. Trustee asks for an independent review first, particularly of minors' data, health data and anything users would reasonably expect to be private (according to The Record), and according to PPC Land the states' joint brief adopts the objection in full. As quoted by PPC Land, the company wrote in its reply that it is operating under substantial liquidity constraints and cannot support a substantially extended process. The company also wrote that it is willing to consent to an appointment under appropriate circumstances and is negotiating with the U.S. Trustee. By PPC Land's calculation, if the sale hearing needs an ombudsman, one has to be appointed by 17 November.

As quoted by PPC Land, the company wrote in its reply that it does not share chat content for advertising purposes, and that users in the UK and EU can opt out of having their data used to train models. In PPC Land's comparison, the advertising line covers only sharing, and the training opt-out is limited to users in the UK and EU. The Bankruptcy Code's definition of personally identifiable information lists data such as a name, address, email address and phone number provided to obtain a service, and as of 2 November we had not found any court ruling on whether conversation content falls within it. PPC Land also wrote that the states' brief does not address that question.

According to The Record, an analyst at the Center for Democracy and Technology (CDT), a privacy advocacy group, says that what people share with chatbots is specific and intimate and can identify them even if names are removed before a sale, and that AI makes inferring sensitive traits easier. "At the very least, customers of the seller should have to opt into the sale of their data to the buyer," she told The Record.

As quoted by PPC Land, the company wrote in its reply that users can request export or deletion of their data through its automated systems and that it honours such requests. The states asked that all users be able to delete their data before any sale, and PPC Land observed that the reply does not address when deletion happens relative to a sale. According to Implicator, data export and account deletion are available in the app and on the website. Implicator also reported that the policy allows the company to keep some information for legal obligations or disputes, and that characters a user made public may remain after the account is deleted.

Based on Implicator's report that the platform will shut down if no buyer is willing to keep it running, we infer that people who want to keep their conversations can export them first. Those concerned about their conversations being transferred can consider requesting deletion, though the company's reply does not say whether deletion would be completed before the sale.

The next points to watch are whether an ombudsman is appointed before 17 November, and whether what the 24 November sale hearing approves includes user data and conversations.

We, a community based in Taiwan, compared how the personal data laws of Taiwan, South Korea and Japan treat personal data that moves with a business in a transfer or merger. Taiwan's Personal Data Protection Act has no provision specifically on transferring personal data in a business transfer or merger (based on a full-text search of the Act, without reading its enforcement rules or official interpretations). Article 20(1) requires a non-government agency to use personal data (apart from the categories of sensitive data listed in Article 6(1)) within the scope necessary for the specific purpose of collection, and whether that purpose still binds a buyer is our reading of the text, as we found no official interpretation on the point.

Article 27 of South Korea's Personal Information Protection Act requires a company that transfers personal data through the transfer of all or part of its business or a merger to tell the people concerned in advance about the transfer, the recipient's name and contact details, and how they can act if they do not want their data transferred. The recipient may use the data only for the original purpose at the time of transfer. Under Article 27(5)(ii) of Japan's Act on the Protection of Personal Information, a company receiving personal data through a merger or other succession of business does not count as a third party, so the rule requiring consent for provision to third parties does not apply, while Article 18(2) bars handling the data beyond the purpose of use before the succession without the person's consent. Neither of these two Japanese articles requires notice to the person in advance (we did not look at other provisions), and we did not check how the Korean and Japanese provisions apply to a sale in bankruptcy.

When comparing sales like this one, readers can look at how many times the privacy policy changed before the bankruptcy filing, whether users were notified, whether the assets for sale include conversations, whether the buyer has to keep the original policy, and whether users can opt in or out beforehand. Since the Bankruptcy Code's definition lists data such as names and addresses, whether an ombudsman's review can cover conversation content is also worth following. Another question is whether a review would lengthen the process (as the company argues, according to PPC Land), and whether, with the company's funds constrained, that would make it more likely that no buyer is found and the platform shuts down.