When a tech company goes bankrupt, its user data is usually treated as an asset that can be sold. Courts, privacy policies and state regulators can attach conditions to a sale, and users can still export, delete and object.
The Verge reports that Character.AI’s user data may be sold as part of its bankruptcy proceedings. According to the publication, the New York Attorney General’s office has disclosed a multi-state investigation into the company that has run for several years. It is now seeking protections for consumer data sold through the bankruptcy. The Verge also reports that 40 attorneys general from both parties have filed a notice of interest in the case, which tells everyone involved that regulatory issues are at stake. Which data will be sold, who will buy it and on what terms has not been made public. The steps below apply to any user of any service in this position.
Gather what you need before starting
Have the following ready:
- The email address and login method linked to your account, including any social sign-in you used.
- Access to that email inbox, because export links and deletion confirmations are usually sent there.
- A note of which US state you live in, or your country if you are outside the US. This decides which regulator and which privacy laws apply to you.
- Some time to read the service’s current privacy policy and terms of service in full.
- A safe place to store anything you download, such as an encrypted folder.
If you used the app on more than one device or with more than one account, list them all. Each account is handled separately.
Read the transfer clause in the privacy policy
Most privacy policies include a section on mergers, acquisitions, bankruptcy or “business transfers”. This clause matters most at this stage. It usually says one of two things:
- personal data may pass to a buyer as part of a sale of the business, or
- personal data will not be sold or transferred without your consent.
Save a copy of the policy as it stands today, with the date. Policies change, and the version in force when you gave your data may matter later. Under US bankruptcy law, a court generally has to consider whether a proposed sale of personal information matches the debtor’s privacy policy. If it does not, the court can appoint a consumer privacy ombudsman to review the sale. A strong promise in the policy gives regulators and the court more grounds to restrict a sale.
Export a copy of what you want to keep
Look in the account or privacy settings for a data download or export option. Some services offer one in the app, and others only respond to a written request sent to a privacy contact address. Whether a particular service offers a working export tool during insolvency is not guaranteed, so do this early. Services can be shut down or have staff cut with little notice.
Keep the export somewhere secure. Chatbot transcripts can include health details, relationship problems, location clues and other sensitive material.
Delete conversations and content you do not want transferred
Data that has been properly deleted before a sale is less likely to be in the assets a buyer receives. Go through your chat history and any characters or personas you created, and delete what you do not want to keep. Remember that deleting something in the app may only hide it from you. The company’s policy should say how long deleted data stays in backups. Where that is not stated, assume some copies may remain for a while.
Close the account and request erasure in writing
Deleting the account usually goes further than deleting individual chats. After you use the in-app deletion option, send a written erasure request to the privacy contact listed in the policy. Ask for confirmation that your data has been deleted, including from backups. Keep the reply.
Your rights depend on where you live. Some US states have consumer privacy laws that give residents a right to deletion. In the UK and EU, data protection law gives a right to erasure. A company in bankruptcy may be slower to answer or may dispute its obligations. A dated written request still gives you a record if questions come up later.
Follow the bankruptcy case and its notices
Bankruptcy cases are public. Court filings, proposed sale terms and objection deadlines are published on the court docket. Large cases often also have a dedicated case information website run by a claims agent. Look for:
- a proposed sale of assets that lists customer data, user content or databases;
- the appointment of a consumer privacy ombudsman and any report they file;
- deadlines for objections to the sale.
Individual users can sometimes file objections, but in practice this is mostly handled by regulators and the ombudsman. Following the docket mainly tells you what is being sold, to whom and when.
Contact your state attorney general or data protection authority
The Verge reports that 40 attorneys general have already shown an interest in the Character.AI case, so regulators are watching. If you have a specific concern, file a consumer complaint with your state attorney general’s office. Examples include a deletion request that was ignored or sensitive data shared by a minor. Outside the US, contact your national data protection authority. Complaints give regulators evidence they can use when they push for conditions on a sale.
Avoid these common mistakes
- Waiting for the sale to be announced. By then, export and deletion tools may be slow or no longer work.
- Thinking that uninstalling the app deletes the account. It does not. Your data stays on the company’s servers.
- Deleting before exporting. Once something is deleted it usually cannot be recovered.
- Forgetting about linked accounts. Social sign-ins and payment records can stay connected to your identity after you delete the main account.
- Leaving exports unprotected. A downloaded archive in a shared cloud folder can expose more than the bankruptcy ever would.
- Relying on screenshots of the policy without dates. Save the full text along with the date you saved it.
Recognise when this approach is the wrong choice
This guide covers protecting personal data. It is not the right route in some situations:
- You are owed money. Refunds, unused subscription credit and other money claims go through the bankruptcy claims process. A data request will not recover them, and you may need legal advice.
- The data concerns a child’s safety. If chatbot conversations involved harm to a minor, contact the relevant authorities or a lawyer. Deleting the data could destroy evidence.
- You want the service to continue. If a buyer may keep running the service, deleting your account means losing your history for good. In that case, exporting and then watching for the buyer’s new privacy policy may be the better choice.
- You are in legal proceedings. If you might be a party or witness in litigation involving the company, get legal advice before deleting anything.
Frequently asked questions
Can a bankrupt company sell my personal data?
Often it can, because customer data is usually treated as a business asset. Under US bankruptcy law, a court generally has to consider whether a sale of personal information matches the company’s privacy policy. If the policy promised the data would not be sold, the court can appoint a consumer privacy ombudsman and may impose conditions or limit the sale. State regulators can also step in to ask for protections.
Does deleting my chatbot account remove my data straight away?
Not always. Deleting an account normally removes data from active systems, but copies can stay in backups for a period set out in the privacy policy. Sending a written erasure request and asking for confirmation gives you a record. Your legal rights to deletion depend on where you live, as some US states and the UK and EU give residents specific erasure rights.
What is a consumer privacy ombudsman in a bankruptcy?
A consumer privacy ombudsman is a neutral person that a US bankruptcy court can appoint when a proposed sale of personal information may conflict with the company’s privacy policy. The ombudsman reviews the proposed sale, considers the privacy risks to customers and reports to the court. The court then decides whether to approve the sale and on what conditions.
Who should I complain to about my data in a company bankruptcy?
In the US, the usual route is the consumer protection division of your state attorney general’s office. In the UK or EU, contact your national data protection authority. Give specific details, such as unanswered deletion requests or sensitive data involved. Regulators can use complaints as evidence when they ask a bankruptcy court to attach privacy protections to a sale.
Sources and further reading
- The Verge, for reporting on state attorneys general and Character.AI’s bankruptcy proceedings.
- The US Bankruptcy Code, for the provisions on selling personally identifiable information and appointing consumer privacy ombudsmen.
- US state attorney general consumer protection offices, for guidance on filing privacy complaints.
- UK and EU data protection authorities, for guidance on the right to erasure.
Surfaced from the rss:verge signal “AI company bankruptcy data”. AI-assisted draft, editorially reviewed.
