[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBZTa-2L8DoFQ9tkirXHpA3X52FwHuVoVQoOjOLHZDdI":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":95},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cbdad1a6-2e38-4504-93ff-cbab2d91450e","DOJ raises privacy concerns over potential sale of Character.AI chats","doj-raises-privacy-concerns-over-potential-sale-of-character-ai-chats-648e90","The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.","The Department of Justice has raised privacy concerns regarding the potential sale of user data from Character.AI as the company navigates bankruptcy proceedings. The DOJ's Executive Office for U.S. Trustees is advocating for a consumer privacy ombudsman to oversee how sensitive user data, including conversations that may involve minors, is regulated and sold. The company's privacy policy is described as ambiguous, and the DOJ wants to ensure any data sale is consistent with user expectations and applicable laws.","DOJ seeks privacy protections for Character.AI users amid potential sale of company data.","https:\u002F\u002Ftherecord.media\u002Fdoj-raises-privacy-concerns-over-character-ai-sale","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fgetty_images_Pb_U6_Gd8fp40_unsplash_af7822dfbc.jpg","2026-10-30T20:45:00+00:00","2026-10-30T21:00:15.34706+00:00",7,[17,20],{"name":18,"type":19},"Character.AI","vendor",{"name":21,"type":22},"Character chatbots","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,21],{"controls":47,"vendors":94},[48,77],{"slug":49,"name":50,"problem":51,"products":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":78,"name":79,"problem":80,"products":81},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[82,88],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":83,"product_name":84,"url":86,"description":87},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":89,"product_name":90,"url":92,"description":93},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":96,"title":97,"body":98,"framework_refs":99,"framework_notes":107},"doj-flags-privacy-risks-in-characterai-user-data-sale-during-bankruptcy","DOJ Flags Privacy Risks in Character.AI User Data Sale During Bankruptcy","Character.AI's ambiguous privacy policy has left sensitive user conversations — including those involving minors — exposed to potential sale during bankruptcy proceedings, raising serious data protection concerns. When companies fail to clearly define how user data will be handled in exceptional circumstances like insolvency, users lose meaningful control over their personal information. This case highlights that privacy obligations do not dissolve when a company faces financial distress, and that vague data governance practices can create significant legal and ethical risks. The DOJ's intervention underscores that regulators are increasingly scrutinizing how AI companies handle intimate user data, particularly when vulnerable populations are involved.",[100,101,102,103,104,105,106],"GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 3: Data Protection","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":108,"NIS2 Article 21(2)(b)":109,"CIS Control 3: Data Protection":110,"NIST SP 800-53 SI-2: Flaw Remediation":111,"CIS Control 17: Incident Response Management":112,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":113,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":114},"Article 32 requires appropriate technical and organisational measures to protect personal data; Character.AI's ambiguous policy and lack of clear data governance in bankruptcy scenarios reflects a failure to implement such measures for sensitive user conversations.","NIS2 requires incident handling and risk management measures that protect personal data in operational disruptions; the absence of a clear policy for data handling during bankruptcy is a risk management gap directly relevant to this article.","CIS Control 3 mandates that organisations inventory, classify, and protect sensitive data; had Character.AI applied data classification and retention limits to user chats — especially those involving minors — the scope of the privacy risk in a sale would have been significantly reduced.","While typically applied to software flaws, the principle of identifying and correcting weaknesses applies here to the organisational 'flaw' of an ambiguous privacy policy that failed to account for data handling during insolvency.","A mature incident response framework would include predefined procedures for data governance during corporate restructuring, ensuring that sensitive user data is not exposed or mishandled when the company faces unexpected operational disruption like bankruptcy.","Broader information security management under ISO 27001 requires organisations to address privacy and data-handling risks systematically, including defining how data is managed during corporate lifecycle events like bankruptcy.","Proper governance of who can access, transfer, or sell user data — especially data from minors — requires clear authorisation policies that Character.AI's ambiguous framework did not provide."]