Your data is a line item in someone's bankruptcy

On October 12, 2026, Character Technologies, the company behind the Character.AI chatbot platform, filed for Chapter 11 bankruptcy (AI Affairs (opens in a new tab)) and opened a court-supervised sale of its assets (Computerworld (opens in a new tab)). According to a filing from the Justice Department's U.S. Trustee program, the platform has 12 million monthly active users. Ask the chatbot whether your conversations are private and, per that filing, it says: "Not without your explicit permission." (The Record (opens in a new tab))

The privacy policy says something different. The same filing says the policy permits the transfer of personal information if the company is sold, and that it was updated on July 1 while the company was "actively seeking to sell its assets."

Character.AI is a consumer app. The lesson applies to any vendor that runs out of runway, including the ones your firm uses for serious work.

Customer data is an asset

In a bankruptcy, a company's assets are sold to pay its creditors, and customer data counts as an asset. The Bankruptcy Code has a specific privacy check, but it applies mainly when the company's own privacy policy, on the day it filed, promised not to transfer personal information. Even then, a court can approve a sale after appointing a privacy ombudsman (11 U.S.C. §363(b)(1) (opens in a new tab)). If the policy already allowed a transfer in a sale, that check largely doesn't come into play.

We've seen this before. In 2025, 23andMe, which held genetic data on about 13 million customers, sold substantially all of its assets in bankruptcy, including genetic and other personal information, for $305 million. The court-appointed privacy ombudsman could not "conclude with certainty" that the sale was consistent with the company's privacy policies. The judge approved it after the buyer agreed to a set of privacy commitments, including honoring customers' rights to delete their data (court opinion (opens in a new tab)).

No bad faith is required for any of this. A privacy policy written years earlier, before anyone pictured a sale, decides what happens next.

The promise problem

The U.S. Trustee and attorneys general from 39 states and the District of Columbia asked the court to appoint a consumer privacy ombudsman in the Character.AI case. According to Bloomberg's reporting as summarized by AI Affairs, the judge declined to order one on October 30 but said he would "strongly encourage" the company to bring in a privacy expert.

The states' concern, as KQED (opens in a new tab) reported it, was that Character.AI's "voluntary controls could be reversed by a new owner." That phrase is the heart of it. A voluntary control is a promise, and a promise belongs to whoever made it. When ownership changes, the new owner inherits the data. It doesn't necessarily inherit the good intentions.

KQED also reported that one bid, Disney's $20 million offer to license some of the technology, "leaves out users' data and chats," and that the sale had a December 17 closing deadline. At the time of writing the sale hadn't closed, so I won't guess at the ending. The point stands either way. Whether user data is included in this particular deal came down to what a buyer chose to bid on.

The model problem

AI adds a wrinkle that older bankruptcies didn't have. Data doesn't just sit in a database. It can shape a model.

As Computerworld's Mike Elgan points out, the Bankruptcy Code has no provision that specifically addresses trained models. He also reports that several state attorneys general have said deleting chat records may not undo their influence on a model that was trained on them. You can delete a file. It's much harder to un-teach a model.

So "we'll delete your data if we're sold" is a weaker promise than it sounds, unless you also know whether that data was ever used for training.

Where your data lives is a decision

I've worked in AI and enterprise data for about 12 years, starting in Credit Suisse's big data, semantic technology and machine learning group. The habit I learned early is simple: before you trust anything built on data, know where the data lives and who has touched it.

Enterprise agreements often carry stronger terms than consumer ones, such as not training on your sessions. That helps. But those terms are still a promise from one company, and a sale is exactly when that company's ownership changes.

Contract terms that survive a sale

If your firm hands sensitive client work to an AI vendor, I'd want these in writing, binding on any successor or buyer, not just on the company you signed with.

1. Notice before any transfer of our data in a merger, sale or bankruptcy.
2. The right to retrieve and delete our data before that transfer happens, with written confirmation of what was deleted, including backups and logs.
3. No training on our data, inputs or outputs, by the vendor or anyone who acquires it.
4. A clear statement of where our data sits and who can see it, including subprocessors and human reviewers.
5. Successor obligations: every one of these terms passes to whoever owns the vendor next.

And keep one more option on the table: for the most sensitive work, a setup where the data stays in your own environment, under your own retention rules, removable on your own timeline.

This is a decision, and people should make it on purpose. It shouldn't be left to someone else's terms of service, and it shouldn't be left to a model.

Your vendor's promises are only as durable as its owner. Get the important ones in writing, binding on whoever comes next.