A chatbot business can change owners. Its users' conversations are harder to separate from the people who shared them. That distinction now sits at the center of a dispute over the proposed sale of Character.AI.

On October 14, a coalition of US attorneys general called for protections for users and children in the Chapter 11 case of Character Technologies, the company behind the service. The filing announced by New York's attorney general addresses both product safety and how a potential buyer might use personal information. These are the states' requests, not a court ruling or confirmation that private conversations have been sold.

The safeguards sought for Character.AI's data

Document 33 in case 26-11603-BLS, filed in Delaware's bankruptcy court, describes records that include conversations, account information and behavioral data. The coalition emphasizes the sensitivity of personal disclosures, including health information shared in chats.

Its proposed safeguards include:

  • Consent and purpose limits: restrictions on using conversations for model training, advertising or other commercial activities beyond what users and parents validly agreed to.
  • Access and deletion: preserving access to personal information and giving consumers an opportunity to delete it before any sale of that data.
  • Product protections: age assurance that goes beyond a self-reported birthdate, safeguards for minors and removal of characters that misleadingly claim professional credentials.

The coalition describes investigations and potential safety and privacy violations. Those allegations are not final adjudications of every reported practice. This article does not infer clinical causation from individual interactions or treat a safety test as a universal measure of harm.

The service remains available, but its future is conditional

Character.AI announced its voluntary Chapter 11 process on October 12, seeking a court-supervised sale. The company says the platform remains operational and subscriptions and billing are unchanged for now. If the process produces no actionable proposal that supports continued operation, the platform will be wound down.

The announcement also says its privacy and security practices remain unchanged and points users to data-export and account-deletion options. That is the company's public position, not an independent audit of how those operations work.

An important practical detail appears in its official export guide: processing a request can take three to four weeks, and the emailed download link expires after seven days. The account-deletion guide warns that deletion is permanent. Neither support document guarantees the outcome of the sale or explains every category of derived data.

An export option is not necessarily an immediate exit.

For engineering teams, privacy includes an exit plan

MnzAI Labs' reading is that the useful question extends beyond the identity of a buyer: which controls over conversation history keep working when responsibility for a product changes hands?

This case does not establish that every AI provider carries the same risk. It illustrates why retention and portability belong in vendor evaluation before a dependency becomes hard to unwind. Conversations, attachments, memories and information used to fine-tune models may follow different paths. Deleting an account is not, on its own, an answer to all of them.

Teams building AI services can map where each category lives, record its permitted uses and test an export before they need one urgently. Processing time, usable file formats and the scope of deletion deserve a place alongside model quality and pricing in the vendor conversation.

If continued service depends on a new owner, a credible exit plan should protect the person who entrusted the platform with their information, not merely keep the application running.