DOJ Flags Privacy Risks in Character.AI User Data Sale During Bankruptcy
Written by AI from the linked story. Not reviewed by an editor. How this works
Character.AI's ambiguous privacy policy has left sensitive user conversations — including those involving minors — exposed to potential sale during bankruptcy proceedings, raising serious data protection concerns. When companies fail to clearly define how user data will be handled in exceptional circumstances like insolvency, users lose meaningful control over their personal information. This case highlights that privacy obligations do not dissolve when a company faces financial distress, and that vague data governance practices can create significant legal and ethical risks. The DOJ's intervention underscores that regulators are increasingly scrutinizing how AI companies handle intimate user data, particularly when vulnerable populations are involved.
Tactical Insight
Immediate actions
- Conduct a data minimization audit to identify and purge unnecessary sensitive user data, especially conversations involving minors, before any asset transfer occurs.
- Appoint a consumer privacy ombudsman or data protection officer to oversee any data sale or transfer process to ensure compliance with existing user consent and applicable laws.
Long-term improvements
- Rewrite privacy policies to explicitly address data handling in bankruptcy, acquisition, or wind-down scenarios so user expectations are clearly set from the outset.
- Implement data classification frameworks that flag sensitive categories (e.g., data from minors) and enforce stricter handling, retention limits, and transfer restrictions.
- Establish contractual data protection clauses in any future M&A or asset sale agreements to bind acquiring parties to the original privacy commitments made to users.
Governance and compliance measures
- Require regular third-party privacy audits to assess whether actual data practices align with stated privacy policies.
- Create an incident response playbook specifically addressing data governance during corporate restructuring, including notification obligations to regulators and users.