The Black Box 012: Bankruptcy Law Guards Data a Company Promised Not to Transfer. Character.AI's Policy Makes No Such Promise.
Bot Mutiny |
The privacy safeguard 40 attorneys general cited switches on only when a company promised not to transfer user data. Character.AI's policy says the opposite.
The Black Box 012: Bankruptcy Law Guards Data a Company Promised Not to Transfer. Character.AI's Policy Makes No Such Promise.
The privacy safeguard 40 attorneys general cited switches on only when a company promised not to transfer user data. Character.AI's policy says the opposite.
October 20, 2026
Page 25 of a 28-page filing in the District of Delaware ends with a sentence about the Character.AI bankruptcy that is easy to read past. It closes a notice from a coalition of 40 attorneys general, the District of Columbia's among them, after nine conditions they want attached to any sale. Each State, it says, "reserves its rights, including the right to seek the appointment of a consumer privacy ombudsman under 11 U.S.C. §§ 332 and 363(b)(1)."
A reservation of rights is a lawyer's way of saying "not yet." It costs nothing to file and commits no one to anything.
The interesting part is the citation. Section 363(b)(1) is the clause in the Bankruptcy Code that decides when a company's users get an independent privacy officer in the room before their data is sold. It has a condition attached. Character Technologies, the company behind Character.AI, does not appear to meet it.
The number
By the company's own records, cited in a Kentucky complaint and repeated in the states' notice, more than 21.6 million U.S. accounts had been created by March 13, 2025, and more than 2.1 million of them listed an age under 18.
What Congress built
Section 363(b)(1) reads, in the part that matters: "if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless" the sale is consistent with that policy, or a court approves it after a consumer privacy ombudsman is appointed, after notice and a hearing, "giving due consideration to the facts, circumstances, and conditions of such sale or such lease," and "finding that no showing was made that such sale or such lease would violate applicable nonbankruptcy law." That last finding matters here, because state privacy law is the states' strongest lever.
Section 332 sets out the ombudsman's job. If a hearing is required under 363(b)(1)(B), the court "shall order the United States trustee to appoint" a disinterested person at least seven days before the hearing. The ombudsman may tell the court about the debtor's privacy policy, the privacy gains or losses a sale would cause, its costs and benefits to consumers, and alternatives that would reduce the losses. The ombudsman may not disclose anyone's personal information.
The definition of "personally identifiable information" sits in Section 101(41A). It covers a first name or initial and last name, a home address, an email address, a home telephone number, a Social Security number or a credit card account number, when given to obtain something "primarily for personal, family, or household purposes." It also covers "any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically," when that information is tied to one of the listed identifiers. A birth date is on that second list by name.
The states' notice lists what Character.AI holds. Account information: "names, email addresses used for login and declared ages." Chat and call content: "the text of users' conversations with characters and audio-call interactions, including any mental-health disclosures and other health-related statements by users, including minors." Behavioral data, device identifiers, and payment details for subscribers round it out.
Login email addresses are on the statute's list by name, and full names would be too where users gave them. Declared ages and chat logs attached to those accounts have a reasonable claim to the second list, though no court in this case has ruled on that.
So the data fits the definition. The open question is the first condition: a policy "prohibiting the transfer."
The policy
Character.AI's privacy policy, effective July 1, 2026, has a section on business transfers. It reads: "We may disclose certain information, in connection with or during negotiations or closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company."
That sentence permits transfer in a sale of company assets. Read against 363(b)(1), the statute's trigger is a promise the policy in effect at filing does not make. The clause does say "certain information," and does not mention bankruptcy, which leaves the states room to argue that a separate sale of chat logs reaches further than it allows.
The competing readings
The first reading is the ordinary one, and it deserves its full weight. Business-transfer clauses like this one are common in consumer privacy policies. Users are told up front that a sale could move their data. The statute was written to stop companies from breaking a specific promise, and here no such promise was given. On this reading, nothing is broken. Congress chose to protect reliance on a stated policy, not every user's preferences. The states also have other tools: their own privacy statutes, consumer-protection law, objections at the sale hearing, and leverage over any buyer who wants to operate in their states. The reservation of rights is routine, and the citation to 363(b)(1) is a placeholder that keeps an option open.
The second reading is that the reservation points at a safeguard that, on its plain terms, does not activate here, so that any privacy review in this case will have to come from agreement or a motion rather than from the statute's command.
Why the second reading holds
The text gives the trigger and the policy does not meet it. The statute's opening condition is a disclosed policy "prohibiting the transfer." The business-transfer clause permits disclosure in a "sale of company assets." No reading of "we may disclose" turns it into a prohibition.
The most recent large consumer-data bankruptcy shows both the argument and its limits. In 23andMe's case in the Eastern District of Missouri, the company argued that no ombudsman was required because its policy allowed transfer. That policy named bankruptcy outright: customer data "may be accessed, sold or transferred" in a bankruptcy or sale of assets, language added in June 2022. The U.S. Trustee, Texas and Missouri each moved for an ombudsman, and a joint motion from more than a dozen states sought one too. The court did not grant the company's request for a finding that none was needed. On April 29, 2025, the court entered a joint stipulation and agreed order, which the company signed, directing the U.S. Trustee to appoint an ombudsman. It was not a ruling that the statute required one. The Trustee named Neil Richards of Washington University on May 6, and he filed his report on June 11, 2025.
That outcome matters for what an ombudsman can deliver even when one is appointed. Richards recommended opt-in consent from customers before their data moved to a buyer. Judge Brian Walsh's opinion agreed that consent requirements "would provide robust protections for consumers," then declined to impose them, giving three reasons tied to that transaction. The court approved the $305 million sale to TTAM Research Institute, the nonprofit led by co-founder Anne Wojcicki.
Character.AI's schedule leaves less room than 23andMe's did. Under the proposed bidding procedures as reported by PPC Land from the filed motion, which still need court approval, bids would be due November 20, the auction would be November 23, the sale hearing November 24, and the outside closing date on the stalking-horse deal is December 17. If an ombudsman is appointed under 332, the appointment has to come at least seven days before the hearing.
The named parties
Character Technologies filed for Chapter 11 on October 12, 2026, case 26-11603 before Judge Brendan Linehan Shannon. CEO Colin Adams said the "court-supervised sale process provides the Company with the best opportunity to maximize value for all stakeholders."
Disney is the stalking-horse bidder at $20 million, for a non-exclusive, perpetual license to code and patents. The license agreement, Section 3.2 as quoted by PPC Land, excludes "any consumer-facing applications of Licensor," "Licensor's end user data or databases, any personally identifiable information of Licensor end users," and "training data or any Finished Models." The user data stays in the bankruptcy estate.
Adams said in a statement that if no bid keeps the service running, "the platform will be wound down." A banker's declaration filed in support, from Adam Dunayer, says an earlier process run by a prior banker, hired in August 2025, approached about 28 parties and drew "only one proposal that was ultimately not deemed to be actionable," with buyers citing "the litigation and regulatory overhang."
The states' notice was filed October 14 by NAAG bankruptcy counsel on behalf of the coalition. New York Attorney General Letitia James said: "This company collected some of the most private thoughts children have ever shared, and now those conversations could be sold off to the highest bidder." The next day, California Attorney General Rob Bonta announced the filing in a release naming 22 of California's co-filers, saying the states asked the court "to address privacy and safety concerns in any sale or transfer of the company's business or assets."
The notice also says the company's removal of open-ended chat for users under 18 "is voluntary and could be rolled back at any time, including by a purchaser."
What the instrument cannot see
Section 363(b)(1) looks at one document: the policy in effect on the filing date. It does not look at how old the users are or what they said. A policy that promised not to share a mailing list triggers the safeguard. A policy that reserves the right to disclose data in a sale, held by a company whose users include more than 2.1 million declared minors and whose chat logs include mental-health disclosures, does not.
So the protection depends on how the policy was drafted, and the sensitivity of the data does not enter into it. Any company can write a business-transfer clause, and once one is written, the statute's safeguard is no longer automatic. The policy does not tell users that the clause has that effect.
The tell
The company's public line is that customer data "continues to be protected under our Privacy Policy." That statement is accurate as far as it goes. The policy it points to is the same one that permits disclosure in a sale of company assets.
The states' own conditions show what they think is missing. Their eighth condition asks for "allowing all consumers the opportunity to delete their data prior to any sale of that data." That is a protection the statute does not supply here, so they are asking the court and any buyer to supply it by agreement.
The record
What the documents establish:
- Section 363(b)(1) requires a court-approved ombudsman review, or consistency with the policy, only when the debtor disclosed a policy prohibiting transfer of personally identifiable information.
- Character.AI's privacy policy permits disclosure in a "sale of company assets."
- The states' notice reserves the right to seek an ombudsman under 332 and 363(b)(1) and lists nine conditions for any sale.
- More than 2.1 million U.S. accounts listed an age under 18 as of March 13, 2025, by the company's records as cited in the Kentucky complaint.
- Disney's license, as reported from the filed agreement, excludes end-user data and personally identifiable information, which stay in the estate.
- In 23andMe, with a business-transfer clause that named bankruptcy explicitly, the ombudsman came by stipulation after the U.S. Trustee and states moved for one, and the court declined the ombudsman's opt-in recommendation.
What the documents do not establish:
- That Judge Shannon would refuse an ombudsman if one is requested. The U.S. Trustee or the states could move for one, courts have equitable powers, and debtors have agreed to appointments before.
- That anyone has bid, or will bid, for the user data. No such bidder has been named.
- What happens to the data if the platform is wound down with no buyer for it. The filings reviewed for this piece do not say.
- Whether any earlier version of Character.AI's policy, as opposed to the one in effect on the filing date, made a narrower promise. The statute looks at the policy in effect at filing.
Close
The states cited the right section. The section asks whether Character.AI promised not to transfer user data, and the answer is in the company's own policy. If the 2.1 million accounts that declared an age under 18 get an independent privacy officer before the sale hearing, it will most likely come by agreement or by a motion from the U.S. Trustee or the states, not because the statute requires it.
Source note: States' Notice of Interest and Reservation of Rights, Doc. 33, In re Character Technologies, Inc., No. 26-11603 (BLS) (Bankr. D. Del. filed Oct. 14, 2026); 11 U.S.C. §§ 101(41A), 332, 363(b)(1); Character.AI Privacy Policy, effective July 1, 2026, read Oct. 18, 2026; Declaration of Adam Dunayer, Doc. 17, and bidding procedures motion with stalking-horse agreement, Doc. 15, as reported by PPC Land; In re 23andMe Holding Co., No. 25-40976 (Bankr. E.D. Mo.), memorandum opinion approving sale (June 2025) and joint stipulation and agreed order directing the U.S. Trustee to appoint a consumer privacy ombudsman (Apr. 29, 2025); press releases of the New York Attorney General (Oct. 14, 2026) and California Attorney General (Oct. 15, 2026); company statements quoted by TechCrunch (Oct. 13, 2026) and Straight Arrow News; Commonwealth ex rel. Coleman v. Character Techs., Inc., No. 26-CI-00029 (Franklin Cir. Ct. filed Jan. 8, 2026), as cited in Doc. 33.