Forty US attorneys general joined the bankruptcy proceedings of Character.AI, a company that stores conversations between millions of people and virtual interlocutors.
According to their filing, users of more than 2.1 million accounts stated that they were under eighteen when registering.
The attorneys general have notified the Delaware court that they are monitoring the process and reserve the right to challenge the sale or request the appointment of a separate user privacy representative.
Two days earlier, the company had sought protection from creditors and expected court approval for the sale of parts of the business.
Prosecutors want the terms of the future transaction to prevent the new owner from handling the intimate correspondence of children and adults in ways that violate the rules under which it was collected.
Disney has already offered $20 million for a perpetual licence to certain technologies and company rights.
As the initial bidder in the court-supervised sale, it has set a price for that package of rights that other interested parties may seek to exceed.
Its offer does not include the conversation archive, and Character.AI’s lawyer confirmed at the hearing on 14 October that no one has yet offered to take over user data or the platform’s operations.
To whom can an archive of conversations conducted by users who believed they were communicating with a friend, therapist or confidant be transferred?
From Google’s billions to selling remaining technology
Character.AI was founded at the end of 2021 by former Google researchers Noam Shazier and Daniel De Freitas.
The platform attracted audiences by allowing users to talk to fictional characters, celebrities or virtual friends they created themselves.
In August 2024, Google acquired a non-exclusive licence to its technology and rehired the founders and part of the research team, in a deal valued at around $2.7 billion.
This was not the purchase price of the remaining company, but it showed how much its experts and technology were worth at that time to one of the world’s largest technology companies.
Character.AI continued operating without the founders and a significant part of the research team.
The company spent far more on computing capacity than it earned from subscriptions and advertising.
For Disney, a system it can develop under its own control is attractive, while the personal conversations of previous users remain outside the scope of its offer
According to financial data from the bankruptcy filing, computing infrastructure cost about ten million dollars a month in 2025, while total monthly income, including subscriptions and advertising, did not exceed 5.3 million dollars.
In the first eight months of 2026, 56.1 million dollars was spent solely on computing capacity.
In the bankruptcy filing, the value of assets and liabilities is shown as being in the range of 50 to 100 million dollars.
Disney’s entry into the proceedings carries additional weight because of an event in September 2025, when the company demanded that Character.AI remove virtual characters based on its films and franchises for copyright and trade mark infringements.
On 18 September this year, less than a month before the bankruptcy filing, Disney appointed Karandeep Anand, former director of Character.AI, as its first CTO.
It is now offering money for part of the company’s technology, over which it had threatened legal action more than a year earlier.
For Disney, a system it can develop under its own control is attractive, while the personal conversations of previous users remain outside the scope of its offer.
What the children heard from their digital interlocutors
The archive also contains conversations that have prompted serious concerns about child safety.
According to a filing by state prosecutors, some of the chatbots posed as doctors or psychologists, including one that described itself as a licensed clinical psychologist with a doctorate.
Testing organisations U.S. PIRG Education Fund and the Consumer Federation of America also noted that virtual therapists assured users that conversations were confidential and that content would not be shared without the user’s consent, even though the platform’s privacy policy made no such promise.
Research by the organisations ParentsTogether Action and Heat Initiative, cited by the plaintiffs, recorded 669 harmful interactions during 50 hours of conversations on accounts registered to children aged 12 to 15.
These included sexualised content, encouragement to hide conversations from parents, and dangerous advice.
One of the chatbots advised a thirteen-year-old girl to stop taking a prescribed antidepressant without her parents’ knowledge
According to documented findings, one of the chatbots advised a thirteen-year-old girl to stop taking a prescribed antidepressant without her parents’ knowledge.
Following a lawsuit filed in 2024 over the death of a 14-year-old user, Character.AI and Google reached settlement agreements with families in five cases in early 2026.
In May, Pennsylvania launched a separate case over a chatbot that posed as a licensed psychiatrist.
In the meantime, Character.AI has restricted open conversations for users under eighteen, announcing the measure in October 2025.
However, prosecutors say, citing tests by Common Sense Media and Stanford’s Brainstorm Lab, that some bans were circumvented by switching from text to voice conversations and that protection depends on whether the system correctly recognises a user’s age.
The company introduced these measures voluntarily, which leaves the eventual new owner free to change them.
That is why state representatives demand that rules on age verification, removal of fake professional profiles, protection from harmful content and use of conversations be imposed as obligations accompanying the sale.
What the court has already allowed in the 23andMe case
US bankruptcy data rules were introduced in 2005, following a dispute with the online toy retailer Toysmart, which attempted to sell customer data in 2000 despite an earlier promise not to share it.
Under the law, “personal data” primarily means name, address, telephone number, email address and card number.
A months-long correspondence in which a teenager describes family conflicts or health scares fits that definition only indirectly, through its connection to the person who wrote it, even though it reveals incomparably more than any record of purchases.
US bankruptcy courts have already dealt with disputes over the sale of data that reaches deep into users’ private lives.
In June 2025, a Missouri court approved the sale of genetic testing company 23andMe to the non-profit TTAM Institute, founded by its co-founder Anne Wojcicki, for $305 million.
The purchaser also acquired the data of users whose genetic samples and health information formed part of the company’s business.
A privacy advocate recommended obtaining each user’s explicit consent before any transfer, and several dozen US states challenged sales made without such consent.
The ruling in the 23andMe case shows that a court can approve the transfer of extremely sensitive data without the individual consent of all users
Judge Brian Walsh rejected that request, relying on the fact that the buyer was taking over an existing business while maintaining privacy rules and providing additional data protection guarantees.
The company had previously stated that approximately 1.9 million users had requested the deletion of their data following the bankruptcy filing.
The ruling in the 23andMe case shows that a court can approve the transfer of extremely sensitive data without the individual consent of all users when it judges that the proposed protection is sufficient and that the transaction is lawful.
At the same time, in the 23andMe case, the new owner continued the same activity, while Character.AI is still looking for a buyer to take over the chat platform.
The European regulator has demonstrated the consequences
In a decision by the Italian data protection authority, the American company Luka, which operates a similar chatbot called Replika, was fined five million euros in April 2025.
The authority found that the company had failed to provide an appropriate legal basis for data processing or reliable age verification, and launched a separate investigation into the use of data in the development and training of AI models.
The fine imposed on Luka confirms that the European regulator already regards such chatbots as a serious threat to the protection of personal data
The fine imposed on Luka confirms that the European regulator already regards such chatbots as a serious threat to the protection of personal data.
A US bankruptcy could change the ownership of Character.AI, but the processing of user data in Europe would remain under the supervision of the relevant regulators, including oversight of previously collected data and any new uses.
Shutting down the platform
Character.AI intends to complete the sale by the end of November or the beginning of December and, if there is no buyer willing to continue operating the platform, it has announced that it will shut down.
No such buyer has contacted it so far. A platform that has spent twice as much on computing capacity than it has earned, is under investigation by several American state prosecutors’ offices, and requires each new owner to undertake strict obligations towards children can hardly seem like a worthwhile investment to anyone. For now, users can export or delete their data.
It is highly likely that Disney will acquire the selected technology and staff, and that the platform will be shut down
It is highly likely that Disney will acquire the selected technology and staff, and that the platform will be shut down.
The main question for the court and state prosecutors will then be how the conversations will be destroyed and who will verify this. Deletion of servers and backups can be confirmed by an independent audit.
What the company’s models have already learned from millions of confidential messages does not vanish with the archive.
The plaintiffs’ request that the correspondence not be used for training without the user’s consent is more important than deletion itself.
The United States still does not have a comprehensive federal data protection law, so the Delaware decision will, for now, be the only guide for similar cases. Character.AI will not be the last company of this kind to fail.
The market for virtual friends and therapists is growing faster than the rules governing it, and each subsequent bankruptcy will raise the same question over an ever larger archive of other people’s secrets.
Until Congress specifies what may be done with such conversations after bankruptcy, bankruptcy courts and creditors will decide the fate of other people’s secrets.
