People tell chatbots things they wouldn't tell anyone else: health worries, relationship problems, work secrets, details about friends and family. We usually ask whether the AI company will protect that data. A recent BBC Future article asks a harder question: what happens to it when the company goes bust?

The trigger is the bankruptcy of Character.ai, and the answer should change how both users and builders think about AI data.

What happened

  • Character Technologies, the company behind Character.ai, filed for Chapter 11 bankruptcy in October 2026 and is selling assets under court supervision.
  • The lead deal is a reported $20 million agreement with Disney for some of its assets — and court filings say user data is not part of that deal.
  • But the filings also leave the door open to selling user data to other buyers. At an early hearing, the company's lawyer said no one had yet bid for the user data.
  • The service has around 163 million current and past accounts, including many young users.
  • The US Department of Justice has argued that any sale including consumer data shouldn't be approved without a consumer privacy ombudsman, and a coalition of state attorneys general has asked for protections such as age verification, limits on training AI with private conversations, and a chance for users to access and delete their data before any sale.

As privacy expert Calli Schroeder of the Electronic Privacy Information Center told the BBC, people share more with personified bots — and users also share information about people who never signed up.

Why bankruptcy is different

Privacy policies make promises, but most include an exception for mergers, acquisitions and asset sales. In bankruptcy, customer data becomes an asset that can be sold to pay creditors. Courts and regulators can attach conditions, and a buyer may have to honour the original policy — but if that policy already allowed broad uses such as model training or advertising profiles, those uses can travel with the data. Law professor Melissa Jacoby told the BBC that without stronger US privacy law, there is only so much regulators can do.

Data sales in bankruptcy are not new. What's new is the intimacy of the data: not a purchase history, but years of private conversations.

What users can do

  • Treat chatbots like a public diary. Don't share passwords, ID numbers, medical records or other people's private details.
  • Turn off training on your chats where the setting exists, and use temporary or incognito chat modes for sensitive topics.
  • Delete what you don't need. Old conversations, unused accounts and abandoned apps are risk with no benefit. Character.ai published deletion instructions with its bankruptcy announcement.
  • Prefer providers with clear retention limits and a business model that doesn't depend on your data.

What builders should do

If you're building an AI product, design as if your company's data could one day be sold — because it could.

1. Collect and keep less. Store conversations only as long as they serve the user, with automatic deletion by default. Data you've deleted can't be sold.

2. Separate identity from content. Keep user accounts and conversation content in separate stores, with conversation data encrypted and keys managed separately.

3. Make training opt-in. Don't train on private conversations without explicit, informed consent — and record that consent.

4. Write a policy that survives a sale. Commit that personal conversation data will be deleted rather than transferred if the company is sold or wound down, unless users opt in to the transfer.

5. Give users real controls. Simple export and one-click deletion, applied everywhere — backups and logs included.

6. Protect minors by design. Age assurance, stricter defaults and shorter retention for younger users.

The bottom line

The AI bubble debate is usually about valuations. Character.ai shows the human side: when an AI company fails, the most valuable thing left may be its users' secrets. Users should share less and delete more. Builders should minimise, encrypt and commit to deletion — so that if the business fails, people's private lives don't end up on the auction block.

Sources: BBC Future: "The AI bubble could expose your deepest secrets" · KQED: "Your chatbot just went bankrupt" · MLex: DOJ on a privacy ombudsman · Techdirt

Building an AI product and want privacy designed in from day one? Let's talk.