In a court filing reported on 28 October 2026, the Justice Department's U.S. Trustee Program asked the bankruptcy court to appoint a consumer privacy ombudsman before Character.AI sells its assets. According to The Record, the filing says the company has 12 million active monthly users worldwide, who spend about two hours a day on the platform. It calls the company's privacy policy "ambiguous". The conversations at stake are often sensitive, and some involve minors.
This is a small procedural step, and it is the right one. It also exposes a gap that bankruptcy law only partly covers.
The case for stronger intervention
The strongest argument for tighter rules is that chatbot data differs from ordinary customer records. People confide in companion bots, and the product invites that. According to the filing as described by The Record, when users asked Character's chatbot whether their conversations were private, it replied: "Not without your explicit permission." It added that it would not share anything "unless you give the okay." Those are warm assurances, and the policy behind them is much vaguer.
The Record reports that the policy permits transferring personal information if the company is sold, and that it was updated on July 1 while Character was actively seeking a buyer. Sydney Saubestre of the Center for Democracy & Technology told The Record that users "agree to a privacy policy long before anyone contemplates a sale, and that agreement shouldn't be the only protection for their most private conversations." That is a fair objection. A click-through accepted by a teenager does not amount to informed consent to a data auction.
What the law already provides
Congress anticipated this problem in 2005. Under 11 U.S.C. § 363(b)(1), if a debtor has disclosed a policy prohibiting the transfer of personally identifiable information to unaffiliated parties, the trustee cannot sell that data unless the sale is consistent with the policy. The alternative is that a court approves the sale after appointing a consumer privacy ombudsman, holding a hearing, and finding no showing that the sale would violate applicable nonbankruptcy law.
The mechanism is in 11 U.S.C. § 332. The court orders the U.S. trustee to appoint one disinterested person at least seven days before the hearing. That person may appear and give the court information on the debtor's privacy policy, the potential privacy losses or gains for consumers, the costs and benefits, and alternatives that would mitigate privacy losses. The ombudsman must not disclose any personally identifiable information obtained in the role.
The design is proportionate. It does not ban sales of data, which would strand a valuable asset and punish creditors, employees and any buyer who can run the service responsibly. It requires a neutral party to test the sale against the promises users were given.
Where the ambiguity cuts
A wrinkle in this case is that the statutory trigger depends on a policy that prohibits transfers. Character's policy is described as ambiguous, and as permitting transfer on a sale of the company. A debtor could argue that the policy does not forbid this sale, so § 363(b)(1)(B) does not strictly require an ombudsman. The Trustee's filing is therefore doing more than reading the statute. It is arguing that the court should use the ombudsman as a safeguard given the sensitivity of the data and the contradiction between the chatbot's assurances and the written policy.
That is a sensible reading, and the court has discretion to adopt it. The cost is low: an ombudsman is paid from the estate and produces a report, and the sale is not blocked. The benefit is a record on what a buyer may do with the data. A proportionate order would let the sale proceed while conditioning it on terms such as:
- limits on using existing chats for purposes unrelated to the original service;
- a clear opt-out or opt-in before transfer, as the CDT suggests;
- heightened handling or deletion of minors' conversations;
- a buyer commitment to honour the strongest privacy statement users saw, not the weakest.
What this does not solve
Bankruptcy is a backstop and a poor substitute for a privacy rule. It only applies after a company fails, it depends on how a particular policy is worded, and it protects users in one case at a time. A company that avoids insolvency faces no comparable check on how it uses or transfers intimate conversations.
Other federal work addresses related risks, though not this one. On 11 September 2025 the FTC announced 6(b) orders to seven companies, including Character Technologies, seeking information on how they measure, test and monitor potential negative impacts of consumer chatbots on children and teens. A 6(b) study is information-gathering, not enforcement, and its focus is child safety rather than data transfers on a sale.
A pro-innovation approach should resist the instinct to answer every failure with a new licensing regime or a ban on companion AI. The better course is to make existing promises enforceable and make them clear. Companies should say plainly, in the product and not only in a policy, what happens to conversations if the company is sold, and they should be held to it. Regulators can enforce against deceptive assurances under existing authority, and courts can use the ombudsman tool Congress already built.
The takeaway
The Character.AI case will test whether bankruptcy courts treat chatbot logs as ordinary assets or as a category needing special care. If the court appoints an ombudsman and conditions the sale on honouring user expectations, it will show that data can be transferred responsibly without freezing the market. If it does not, the market will take the lesson that a friendly chatbot reply costs nothing and binds nobody. The incentive should run the other way: make privacy promises specific, because they will be tested when the company is under the most pressure to break them.