On 12 October Character.AI filed for bankruptcy
Character Technologies, the company behind Character.AI, filed for Chapter 11 protection at the Delaware bankruptcy court on 12 October. It wants to sell its assets under the judge's supervision and already has a first bidder: Disney, which is putting 20 million dollars on the table for a non-exclusive, perpetual licence to part of its intellectual property. In the petition the company lists assets and liabilities of between 50 and 100 million dollars. If nobody buys it, the service will be shut down.1
Character.AI is the app where you chat with characters invented by users or modelled on famous figures, from comic-book heroes to imaginary psychologists. According to a declaration by its CEO, Colin Adams, it has about 12 million monthly active users, who spend an average of 120 minutes a day on it. In August it took in 5.3 million dollars a month and lost between 8 and 9 million; from January to August it spent 56.1 million on computing power alone. From August 2025 an investment bank sounded out 28 possible buyers and received a single proposal, judged unworkable. Investors, Adams writes, were put off by the lawsuits and the investigations.2
The court filings contain another number too. The company explains that notifying all current and past users by post, about 163 million of them, would cost too much, and that in any case they are not creditors. They will hear the news through a blog post and a notice in the app.3
What is still for sale
What matters most is the scope of Disney's bid. According to the sale procedures filed in court, the licence covers code and patents. It leaves out the app, the brand, user data, what users wrote and received, and the trained models. All of that stays in the bankrupt company's estate and can be bought by whoever submits a bid by 20 November. The auction is scheduled for 23 November, the hearing to approve the sale for the 24th, and Disney has set 17 December as its outside date.4
On 14 October the attorneys general of 39 states and the District of Columbia filed a notice setting nine conditions for any buyer: age checks that do not rely on a declared date of birth, no characters presenting themselves as therapists, doctors or lawyers, protocols for self-harm and suicide, no use of chats for training models or for advertising beyond what users have allowed, and the chance for everyone to delete their data before the sale. They reserve the right to ask for a consumer privacy ombudsman, a role that US bankruptcy law provides for precisely these sales.4
The background explains the attention. In 2024 Megan Garcia, a mother in Florida, sued Character.AI, arguing that the platform had played a part in the suicide of her 14-year-old son, Sewell Setzer. Other families followed. In early 2026 the company settled five cases, including Garcia's, and took open-ended conversations with characters away from minors.5 Kentucky and Pennsylvania have sued it, and according to Adams's declaration 46 states and territories are investigating it together.2
What we write into them
To see what is at stake, it is enough to look at how these services are used. In the United States nearly three teenagers in four have tried an AI companion, one in three has chosen to talk about something serious with the AI instead of a person, and one in four has shared personal information.6
In Europe a survey by Ipsos for the CNIL, the French data protection authority, of 3,800 young people aged 11 to 25 in France, Germany, Sweden and Ireland found that 48% use AI to talk about personal or intimate matters. 56% think AI can keep conversations secret, and fewer than one in three say they know what happens to the data they share.7 In Italy the Di.Te. association and Skuola.net surveyed 927 young people aged 10 to 20: 46% have already used a generative AI system to talk about their feelings, and for about one in ten it is a habit.8
Young people confiding in AI, and what they know about their data
These figures are about the young, but the point holds for everyone. In a chat with a character that listens without judging, people write things they would not tell a friend: their health, their sex life, family relationships, their darkest thoughts. And all of it sits on a company's servers.
What the privacy policy promises
Character.AI's privacy policy, with wording in place since at least August 2025, allows it to disclose "certain information" during the negotiation or completion of a sale of company assets. It does not say which, and it does not oblige the buyer to follow the same rules. The company keeps saying that user data "continues to be protected" by the policy, but it has not said whether conversations are among the assets for sale. Calli Schroeder, of the Electronic Privacy Information Center, called the protection offered by the consumer ombudsman "a pretty weak protection" and pointed out that chats like these are also an ideal target for blackmailers.9
As Mario Trujillo of the Electronic Frontier Foundation put it, "Our most sensitive personal information is not an asset to be bought and sold." Robbie Torney of Common Sense Media also points out that deleting an account does not remove what has already gone into training a model.10
No invention stays what it was born for.
Sixth law of innovation, from Un perché alla volta (translated)
A chat built as entertainment, and used by many as a diary, becomes a line in the inventory when the company goes bust.
The precedents: Toysmart, RadioShack, 23andMe
This is not the first time customer data has ended up in a bankruptcy sale, and past cases show how it can go.
In 2000 the Federal Trade Commission sued Toysmart, a failed online toy shop, to stop it selling its customer list against the promises made on its website. In January 2001 Buena Vista Internet Group, a Disney subsidiary that owned 60% of Toysmart, paid the creditors 50,000 dollars to have that list destroyed.11 Twenty-five years later Disney is back at a bankruptcy table, this time as a buyer. In 2015 RadioShack wanted to sell 117 million customer records. After pressure from the FTC and dozens of states, the Delaware court approved a deal with 17 attorneys general: most of the data was destroyed and the buyer got only the email addresses active in the previous two years.12
The closest case is 23andMe, the genetic testing company. On 31 March 2025 the FTC chairman, Andrew Ferguson, wrote that any sale of the data in bankruptcy would remain subject to the promises made to users, and that the buyer should expressly agree to keep them.13 In June, 27 states and the District of Columbia sued to block the sale of genetic data without consent.14 Meanwhile 1.9 million of its 15 million customers had asked for their data to be deleted.15 In the end the court approved the sale for 305 million dollars to TTAM Research Institute, the non-profit led by co-founder Anne Wojcicki, which committed to follow 23andMe's privacy policies "in perpetuity".16
When customer data ends up in a bankruptcy
| Case | Year | Data | Outcome |
|---|---|---|---|
| Toysmart | 2000-2001 | Customer list of an online toy shop | The Disney subsidiary that held shares pays 50,000 dollars to destroy it |
| RadioShack | 2015 | 117 million customer records | Mostly destroyed, only email addresses active in the previous two years sold |
| 23andMe | 2025 | Genetic data of 15 million customers | Sold for 305 million dollars with an obligation to honour the privacy policy; 1.9 million customers had already had theirs deleted |
| Character.AI | 2026 | Conversations of about 12 million monthly users | Excluded from Disney's bid, on sale to whoever bids by 20 November |
There is one important difference. 23andMe's privacy statement said that in a sale its rules would follow the data to the new owner. Character.AI's does not, so the protection that US law builds on the promises made to users has less to hold on to here.9
And for people writing from Europe
For European users the rules are different and stricter, at least on paper. The GDPR also applies to a US company offering its services to people in the Union. It requires that data collected for one purpose not be used for incompatible purposes, and it treats information about health, sex life, sexual orientation and religious beliefs as special categories. A chat with an AI companion is full of them.
Germany's data protection authorities, in their September 2024 position on asset sales, were clear: special-category data, such as health data, can only be passed to a buyer with each person's informed and explicit consent, and a customer database sold as a standalone asset generally requires prior consent.17
Italy's data protection authority, the Garante, knows Character.AI well. In a decision of 3 July 2026 it fined the company 158,000 euros for an inadequate privacy notice, a late impact assessment and EU representative, and ineffective age checks. The service had been available in Italian since 8 April 2024.18 According to the declaration to the court, the company settled by paying 79,000 euros, half, as Italian law allows.2 It is not an isolated case: on 31 March 2023 the Garante temporarily blocked ChatGPT, and in May 2025 it fined Luka, the company behind Replika, another companion chatbot, 5 million euros.19
So the rules exist. Enforcing them on a sale decided by a US judge, for a company that is closing down, is another matter, and time is short.
What I think
I think conversations with a companion chatbot should be treated like medical records. Nobody would accept a bankrupt psychologist's case files being auctioned off along with the chairs in the consulting room. Yet US bankruptcy law looks mainly at what the privacy policy said, and a vague policy becomes a permission.
That is why I believe two things are needed. The first is for companies: anyone offering a service where people confide should state explicitly that in a sale or a bankruptcy conversations will be deleted, except for those who choose to transfer them. The second is for the rules: chats with an AI companion should be excluded by law from saleable assets. In Italy a bill tabled by the MP Giulia Pastorella goes in a similar direction, as it would require chat histories with minors to be wiped within five days.20
In the meantime a simple personal rule applies. I would never use a companion chatbot as a diary, and I would keep names, addresses, diagnoses and anything about other people out of any chat.
What to do now
- ExportAsk for a copyOn Character.AI you request it from your account settings. The help centre says it takes three to four weeks and the link expires after seven days.
- DeleteClose the accountOnly after receiving the copy. Before the sale, as the states are asking, and without waiting for the service to change hands.
- CheckSwitch off trainingAlmost every major chatbot has a setting to keep chats out of training and a temporary chat mode. They are worth turning on.
- Write lessKeep the data outFull names, addresses, identifiable health details, information about children, colleagues and relatives. What you do not write cannot be sold.
Given the court's timetable, anyone who wants to keep a copy of their Character.AI conversations needs to ask for it by the end of October: three or four weeks of waiting run close to 20 November, the day bidding closes.10