When an AI Company Goes Bust, Who Gets the Conversations? Bankruptcy Law and Chatbot Data

When a company goes bankrupt, its assets are sold to pay its creditors. For an AI chatbot company, one of the most valuable assets may be what its users told it. Character.AI’s Chapter 11 filing in October 2026 has turned that from a hypothetical into a court question, and a BBC analysis published October 29 argues it could be the first of many.

The worry is not only about Character.AI. Building and running AI tools is extremely expensive, and some companies may never turn a profit. If the sector consolidates, the conversations, voice recordings and inferred profiles that billions of people have handed to chatbots will pass to buyers, sometimes ones users have never heard of. This piece looks at what US law actually does to protect that data in a bankruptcy, where the gaps are, and what AI companies should fix in their privacy policies before they need to.

Where the Character.AI case stands

Character Technologies, the company behind Character.AI, filed for Chapter 11 on October 12, 2026, in Delaware. It agreed to license some intellectual property to Disney for $20 million as a stalking-horse bidder, and court filings describe the license as excluding user data. We covered the filing in our report on Character.AI’s bankruptcy.

Two days later, a bipartisan coalition of 40 attorneys general filed a notice in the case. In New York Attorney General Letitia James’s announcement, the states said Character.AI holds sensitive information including private chats, voice calls, mental health disclosures, ages and device data, and that this data “could be transferred to a new owner through bankruptcy.” They asked that any sale include effective age verification, a comprehensive privacy program, limits on using private conversations for AI training without valid consent, and a chance for users to access and delete their information before any sale. Our earlier story on the attorneys general’s demands has more detail.

At the first hearing, the company’s lawyer said no buyer had yet made an offer for its user data or chatbot business.

What US bankruptcy law says about personal data

US bankruptcy law does have a specific rule for this situation. Section 363(b)(1) of the Bankruptcy Code limits the sale of personally identifiable information when the debtor’s privacy policy, in force at the time of filing, prohibits transferring it to unaffiliated parties. In that case, a sale can go ahead only if it is consistent with the policy, or if the court approves it after appointing a consumer privacy ombudsman under Section 332 and finds the sale would not violate applicable non-bankruptcy law.

The ombudsman’s job is to advise the court on the privacy effects of the sale and on alternatives that would reduce harm. In past cases, ombudsmen have recommended conditions such as requiring the buyer to be in the same line of business, to honor the original privacy policy, and to give customers notice and a chance to opt out or delete.

That protection depends heavily on what the privacy policy says. If the policy already lists bankruptcy, merger or asset sale as a permitted reason to transfer data, Section 363(b)(1)’s trigger may never be pulled.

The bankruptcy exception in privacy policies

This is the gap the BBC piece highlights. Many privacy policies include a clause saying data may be transferred as part of a merger, acquisition, financing or bankruptcy. “Bankruptcy is frequently listed as one of those exceptions,” Calli Schroeder of the Electronic Privacy Information Center told the BBC. “As soon as a company goes bankrupt, a lot of the protections you thought you had suddenly don’t apply.”

Even where buyers must follow the original policy, that can still leave a lot of room. Schroeder pointed out that Character.AI’s policy allows user data to be used to build features, train models, develop algorithms and build profiles for targeted advertising. A buyer bound by that policy could do the same.

The genetic testing company 23andMe showed how this plays out. Its bankruptcy drew intense scrutiny of what would happen to customers’ DNA data, as we discussed in the privacy issues around the 23andMe sale and in the 23andMe breach settlement. Chatbot logs are arguably more sensitive than genetic data in one respect: they are written in the user’s own words.

Why chat data is a special problem

• It is unstructured. Users disclose health, sexuality, relationships, finances and crimes in free text. That data is hard to classify and hard to strip out before a sale.
• It covers people who never signed up. As Schroeder put it, users talk about their mothers, friends and partners. Those people never agreed to any privacy policy.
• It may involve children. Character.AI is the subject of claims about minors. Data about children carries extra legal protections and extra risk.
• It can be in a model. Conversations used for training may persist in model weights, which can be sold or licensed separately from the raw logs.

What AI companies should do before trouble arrives

These steps are much easier to take while a company is healthy than in the weeks before a filing.

1. Rewrite the transfer clause. Decide whether conversation data can be transferred in a sale at all, and on what conditions. Saying it will only transfer to a buyer that commits to the same protections, with notice and a deletion window, gives users and courts something to hold onto. Captain Compliance’s privacy notice generator drafts disclosures mapped to the laws that apply to your audience; the substance of a transfer commitment is a business and legal decision.
2. Set short default retention for chats. Data that has been deleted cannot be sold. Keep conversation logs only as long as needed for the service, and make that period visible.
3. Separate training data. Keep a record of which conversations were used for training and on what legal basis. A buyer, a court and a regulator will all ask.
4. Make deletion work everywhere. Honor deletion requests in backups and training sets, not just the live database. California’s rules, explained in our guide to the CPRA right to deletion, set a useful bar.
5. Plan for the ombudsman. Keep a current data inventory so that if a sale happens, the company can show the court exactly what is being sold.

What users can do

The BBC’s advice is practical: think about which services hold your most sensitive information, and if you stop using one, try to delete your data. Character.AI said in its bankruptcy announcement that users could delete their data. Deletion rights are not universal, but many companies offer them to everyone rather than running different systems by location.

Frequently asked questions

Can a bankrupt company sell my chatbot conversations?

Possibly. It depends on the privacy policy in force when the company filed, on the court’s decision, and on other laws that apply. If the policy prohibits transfer, a sale usually requires a consumer privacy ombudsman and court approval.

Is Disney buying Character.AI users’ data?

Not under the deal described in court filings. The $20 million agreement is for a non-exclusive license to certain technology, and the filings describe user data as excluded.

What is a consumer privacy ombudsman?

A person appointed by the bankruptcy court to advise on the privacy effects of selling personal data and to suggest conditions that reduce harm to consumers.

Does a buyer have to follow the old privacy policy?

Often, courts and regulators require it as a condition of sale. But if the original policy already allowed broad uses, such as model training or ad profiling, the buyer may be able to do the same.

Character.AI’s case will set a reference point for every AI company that collects conversations and has not yet made a profit. Users trusted these products with things they would not tell a friend. Whether bankruptcy law treats those words as personal confidences or as inventory will depend partly on a judge in Delaware, and partly on a privacy policy most of them never read.