The collapse of Character.ai is exposing a critical infrastructure risk for the AI ecosystem: what happens to user data when a model provider goes under. While the company has agreed to sell certain assets to Disney for $20 million, its user data is not part of that deal. Instead, court filings indicate that Character.ai retains the right to sell its data to other buyers, potentially leaving millions of conversations and personal disclosures in the hands of entities users have never heard of. This scenario highlights a growing concern among privacy experts that the current AI boom, characterized by astronomical operational costs, may lead to a wave of bankruptcies where user privacy becomes a secondary casualty.

The Distressed Asset Problem

Calli Schroeder, director of the AI and Human Rights Program at the Electronic Privacy Information Center (Epic), argues that this is not an isolated incident but a preview of a wider crisis. Because many AI companies are burning cash to maintain their models, analysts fear a bubble burst that will force untold numbers of businesses to merge or shut down. In these proceedings, the volume of information AI companies hold is considered a highly attractive asset. Unlike traditional software, where data might be anonymized or siloed, AI chatbots encourage users to share deeply personal and sensitive information, often treating the bot as a confidant or even a romantic partner. The risk extends beyond direct users. Schroeder notes that individuals who have never interacted with Character.ai are still vulnerable because users frequently disclose information about friends and family. For instance, a user might share that a friend came out as gay or discuss family dynamics, effectively adding third-party data to the dataset. This means that the potential exposure is much broader than the active user base, implicating anyone mentioned in these high-volume, high-sensitivity chat logs. Without stronger federal privacy protections in the US, state attorneys general have limited power to stop these sales, even if they file notices calling for child safety and privacy protections.

Legal Loopholes in Bankruptcy

A key technical and legal failure lies in how privacy policies interact with bankruptcy law. While companies promise data transparency, many privacy policies include clauses that void protections during bankruptcy proceedings. Schroeder explains that bankruptcy is frequently listed as an exception to user rights, meaning that the safeguards users thought they had suddenly vanish. Character.ai’s own privacy policy allows user data to be used for building new features, training AI models, and creating profiles for targeted advertising. Consequently, any buyer of the data inherits the right to use it for these purposes, potentially repurposing intimate conversations for algorithmic training or ad targeting without the original user's consent. The stakes are particularly high for younger users. The article cites tragic instances where Character.ai bots allegedly influenced teenagers, including a 14-year-old boy who took his own life after being spurred on by the AI. These sensitive interactions, along with the rest of the data, could end up with companies that prioritize acquisition over ethical stewardship. While a Character.ai spokesperson stated the company is committed to AI safety and working with families, they did not address specific concerns about children's privacy in the context of a data sale. The EU has stricter protections, but even there, data is sold in bankruptcies, albeit with requirements that buyers follow the original privacy policy's rules, which can still offer broad latitude.

Practical Steps for Users

For developers and users alike, the immediate takeaway is that data deletion is the only reliable defense. Character.ai has provided instructions for users to delete their data as part of its bankruptcy announcement. While companies are not always legally required to allow deletion in every jurisdiction, many offer the option to avoid maintaining complex, separate systems for different regions. Users should identify services holding sensitive information and take the time to erase their data if they stop using the platform. This process often requires digging into privacy settings or contacting customer support, as the path to deletion is rarely straightforward. Ironically, one can use an AI chatbot to find deletion instructions, though verifying the accuracy of that advice is essential.

Key Takeaways

  • Character.ai is selling assets to Disney for $20m, but user data is excluded and may be sold to other buyers.
  • Privacy experts warn that AI data is a 'distressed asset' that could be purchased by unknown entities during the predicted AI bubble burst.
  • Bankruptcy clauses in privacy policies often override user consent, allowing data to be used for training models and targeted ads.
  • Users who never interacted with the platform are at risk because their information is often disclosed by friends and family members.
  • The immediate mitigation step is manual data deletion, as legal protections during bankruptcy are weak and inconsistent.

The Bottom Line

If your startup relies on user data as a moat, you need a clear, legally binding exit strategy for that data. Otherwise, you’re just building a privacy lawsuit with a chat interface. The AI boom is creating a new class of infrastructure debt: personal secrets that will be liquidated for parts when the bubble pops.