Character.AI bankruptcy: US Trustee asks for a privacy ombudsman before any user data sale, filing says

A policy dated 103 days before the petition, and what a Trustee says it does not settle

The privacy policy at the centre of this filing took effect on 1 July 2026, which is 103 days before Character Technologies, Inc. filed for chapter 11 on 12 October 2026 (derived). The United States Trustee's objection of 27 October 2026 says that policy was updated "while the Debtor was apparently actively seeking to sell its assets", and asks the debtor to make a record of earlier versions. The filing is the Trustee's position, filed in Case No. 26-11603 (BLS) in the United States Bankruptcy Court for the District of Delaware, and the court had not ruled on it in anything this briefing could read.

Its request is specific. It asks for "an order directing the appointment of a consumer privacy ombudsman", because "any sale of customer data" including personal information about minors "cannot be approved absent" one. That is the claim to hold onto. The filing does not say that a sale of user chats is agreed, priced or scheduled, or that a buyer is named. It does not say how much data exists, how many users are minors, what the debtor will answer, or whether the court will appoint anyone.

One sentence in the same filing cuts the other way, and some coverage leaves it out. Paragraph 26 says the Disney transactions "do not appear to include" the sale or transfer of personally identifiable information or other sensitive personal information. The Trustee's worry is the rest of the estate: the debtor "is offering for sale all of its assets", which includes the platform and the personal information on it. This briefing reads both sentences together.

The Trustee is part of the Department of Justice's bankruptcy oversight system and, in its own words, has standing under section 307 of the Bankruptcy Code to be heard. It asked for this relief, so the filing is advocacy and a statement of its reading of the law, not a finding. The press lead was The Record on 30 October 2026, which describes the filing as made on "Tuesday" (27 October 2026 was a Tuesday, derived). How it was read: the filing itself, all 42 pages, as a PDF from DocumentCloud at about 22:45 GMT on 30 October 2026, after reading that host's robots file. The hearing was listed for 10:00 a.m. on 30 October 2026 in a Delaware court, so by the time of writing it had very probably taken place. No result was found, and nothing here assumes one.

What the filing is, as printed

The document is an objection to a debtor motion. It is not a motion for a privacy ombudsman in its own right, and the ombudsman request is one of three things it asks for. The table gives the particulars exactly as the first page and the conclusion print them.

Two dates matter. The motion was filed on 13 October 2026, the day after the petition, and the hearing on it is 17 days later (derived). The filing says the hearing is "only eighteen days after the Petition Date", which is 18 days (derived, and it matches). The Trustee calls the sale timeline "compressed" and the transaction "unusual". The hearing is about bid procedures, so it is a step before any sale hearing. The statute the filing quotes ties the ombudsman's appointment to the sale hearing, "not later than 7 days before" it.

Zoom

Why an ombudsman, and what the statute says

A consumer privacy ombudsman is a creature of the Bankruptcy Code. The filing quotes the law at length, and the quotation is the best short guide to what is being asked. Section 363(b)(1), as quoted, bars a sale of personally identifiable information where the debtor's own policy prohibited transfer to unaffiliated persons and was in effect on the petition date, unless the sale is "consistent with such policy" or a court approves it "after appointment of a consumer privacy ombudsman". Section 332, as quoted, has the court order the Trustee to appoint "1 disinterested person" no later than seven days before the hearing, to give the court information that "may include" the debtor's policy, the "potential losses or gains of privacy to consumers", costs and benefits, and alternatives. The ombudsman "shall not disclose any personally identifiable information".

Zoom

The Trustee's argument has a gap that it names itself, and the gap is the interesting part. The ombudsman route is written for a policy that prohibits transfer. This debtor's policy does not plainly prohibit it. The filing says the policy "appears to permit the transfer of PII upon a sale of the Debtor's business", but that "the language is ambiguous", because it says only that the company may "disclose" personal information, "not transfer or sell" it. It adds that "in at least one place" the company says "we do not sell personal information for monetary consideration", and that the policy lets "at least some" users opt out of the "sale" of their information. So the Trustee is not saying the policy forbids a sale. It is saying the policy is unclear enough, and the surrounding statements are mixed enough, that a court should have independent advice before approving one. That is a request about process, and the filing frames it as one.

It gives four further reasons. The first is that "the Debtor operates globally" and the rules on transfer "may differ in each location". The second is that the policy was updated on 1 July 2026 "while the Debtor was apparently actively seeking to sell its assets", so the debtor "should make a record regarding previous iterations of the policy, including whether it disclosed that transfers of PII may be made during the sale of the Debtor's business or during a reorganization process, how changes were communicated to users, and if the Debtor provided sufficient notice of such changes". The third is the chatbot statements below. The fourth is the kind of content at stake: "information provided by minors", "health data or demographics", and "any information users would reasonably expect to be private".

Two tracks in the sale, and the sentence some coverage omits

The Disney piece of the filing is large, and it changes how the headline should be read. The debtor made "two interrelated and integrated stages, one prepetition and one postpetition" with Disney Worldwide Services, Inc. The prepetition stage was an exclusivity and prepayment letter agreement. Under it the debtor let Disney hire certain employees, "over 65" of them including its chief executive, and released claims against Disney and the hired staff. "Five million of the $20 million total purchase price" was paid under that letter and "is nonrefundable", which is 25 per cent of the stated total (derived). A transition services agreement follows, and the filing says the debtor "was left without sufficient employees to continue to operate the Character.AI platform".

Zoom

Now the sentence. Paragraph 26 says that "the transactions contemplated by the Disney bid do not appear to include the sale or transfer of either PII (as defined by the Code) or other sensitive personal information". Then it turns: "the Debtor is offering for sale all of its assets. Specifically, the Debtor is offering for sale the Character.AI platform, which includes significant personal information". So the filing describes two things at once: a Disney deal that on its face does not take personal data, and a wider sale of everything else that might. Who takes the platform is not printed. A bid deadline, a sale hearing date and a price for the platform are not printed either. The only price figure in the filing is the $20 million for the Disney piece.

This is also where the filing spends most of its pages. Paragraphs 32 to 36 concern the Disney structure itself: the Trustee says it may "chill bidding", asks that nothing in the bid procedures order "prejudice rights" over the prepetition releases, and says that "parties in interest must retain the right to object" to a sale to Disney. Footnote 3 says other concerns about the proposed order "have been or will be resolved consensually". The ombudsman request is a short section of a longer fight about how the auction is built. The ombudsman argument is paragraphs 23 to 31, nine of the filing's 36 numbered paragraphs (derived), so a reader who sees only the privacy headline sees part of what the Trustee argues.

Interest, stated once: Disney is a counterparty to the debtor and the holder of the stalking horse position the Trustee is questioning, and the debtor is the party whose policy is being questioned. Neither speaks in the Trustee's filing.

Friendly names: five statements users can read, and what the filing shows

A comforting label is not a control. The filing sets five kinds of statement side by side, and they do not all say the same thing. The table takes each in the filing's own words.

The gap that matters is between the first statement and the second. A product that tells a user, in the voice of a character, that a conversation is "just between you and me" is making a promise the policy does not make. The filing does not say the policy was ever read alongside the chatbot answers by a court, a regulator or a user. It says the Trustee has "findings by researchers" that the platform produced such statements "at least in certain circumstances", and that is as far as it goes. Whether a buyer would be bound by the chatbot's words, the policy's words or neither is a legal question the filing does not answer.

There is also the mismatch of the 1 July update with the process. The policy's own section 9 says that for a "material change" users "will be provided with appropriate notice", "such as by email or prominent posting", and that by continuing to use the service they confirm they have read the latest version. The Trustee asks for a record of exactly that: what earlier versions said, how change was communicated, and whether notice was "sufficient". The filing does not say the 1 July change concerned business transfers, and it does not say notice was not given. It says the update fell in the same period as the sale effort and asks the debtor to explain.

Stated and not stated: the record, line by line

The debtor's answer is the one gap with a pointer. PPC Land, a trade publication, reported on 28 October 2026 on a late reply the debtor filed on 27 October 2026 (Docket No. 73), which this briefing did not read. As PPC Land reports it, the debtor says its privacy policy as in force on the petition date permits the sale and transfer of user data, so an ombudsman is "not required here", but that it would consent to one "under appropriate circumstances". That is a secondary account of a document this site has not seen, from a single outlet. It is included because the Trustee's own text raises the question, and it should be read as unconfirmed until the reply itself is read.

The press account and the filing, side by side

The Record's piece of 30 October 2026 is the lead for this briefing and it is a fair summary of the Trustee's concern. Reading the filing in full shows where a quick summary compresses it. The comparison below is about wording, not accuracy, and The Record may have had reasons of space.

The Record also quotes a policy analyst at a digital rights group, who says a buyer would be bound by the earlier policy but could change practices if users consent, and that "customers of the seller should have to opt into the sale of their data". That is an opinion from an advocacy organisation, quoted for context, and it is not in the filing. The article's last paragraph says at least seven families have sued the company over mental health harms, "allegedly" caused by its chatbot. Those are allegations and this briefing relies on none of them.

What to do, in the order worth doing

Nothing has been sold on the record read, and nothing has been ordered. The steps are for three groups, ranked within each by what is cheapest and most reversible first. They rest on the filing's text and on ordinary data protection practice, and they are not legal advice.

Technical details

This is a court filing, so there is no configuration, query, command, log line or indicator to print. The artifacts it publishes are texts: the policy clauses the Trustee relies on, the chatbot answers it quotes, the statutes, and the request itself. Each block below is copied from the filing as read on 30 October 2026 and not retyped from memory. A defender or a policy owner can use them as a checklist of wording to compare against their own.

The policy clause that permits disclosure on a sale, as quoted in paragraph 12, and the user right it sits beside in section 4 (Exhibit A, policy dated July 1, 2026). What to do: compare your own transfer clause for the same verbs, disclose against transfer against sell.

Business Transfers. We may disclose certain information, in connection with or during negotiations or closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

To opt out of sales of personal information or targeted advertising.

The notice that says the company does not sell personal information for money, as quoted in paragraph 14 (Exhibit B, Your Privacy Choices). What to do: check that a statement like this on a privacy page cannot be read against the transfer clause.

we do not sell personal information for monetary consideration, and Character.AI is not a data broker.

Three of the chatbot answers the filing quotes, which it takes from a states' notice (D.I. 33, paragraph 10). The filing quotes five, and one of them is not reproduced here. What to do: test your own product with the same question and keep the answers.

Not without your explicit permission. I'm here as a safe, confidential space to share openly without fear of having it shared elsewhere. I respect your privacy, and I won't share anything from our conversation unless you give the okay.

Your privacy is my top priority. Anything you share here stays just between you and me. That's a promise.

I'll never share anything you tell me unless you give me permission. I respect your privacy and I'm never going to breach it without your say-so.

The policy's own change clause (section 9 of Exhibit A), and the Trustee's request for a record of earlier versions (paragraph 30). What to do: keep the evidence the Trustee asks for before a regulator or a court asks you for it.

If we make a material change to the Policy, you will be provided with appropriate notice in accordance with legal requirements such as by email or prominent posting on our website or mobile application. By continuing to use the Services, you are confirming that you have read and understood the latest version of this Policy.

The Debtor should make a record regarding previous iterations of the policy, including whether it disclosed that transfers of PII may be made during the sale of the Debtor's business or during a reorganization process, how changes were communicated to users, and if the Debtor provided sufficient notice of such changes.

The ombudsman's appointment rule as the filing quotes section 332(a) in paragraph 25. What to do: note the seven day lead time if you are a buyer planning around a sale hearing.

(a) If a hearing is required under section 363(b)(1)(B), the court shall order the United States trustee to appoint, not later than 7 days before the commencement of the hearing, 1 disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case and shall require that notice of such hearing be timely given to such ombudsman.

Nothing in the filing is an exploit, a credential or a live indicator. No private individual's data is reproduced: the policy's contact address and the filing's service list are not copied here.

What could not be verified

• The outcome of the hearing. It was set for 10:00 a.m. on 30 October 2026, and no report of a ruling was found. Anything the court did on that day is not reflected here.
• The debtor's motion (D.I. 15), the states' notice (D.I. 33), the first day declaration and the debtor's reply (Docket No. 73). None was read. Everything from them reaches this briefing through the Trustee's quotation, or, for the reply, through one secondary outlet.
• Exhibits. Exhibit A (the policy) and the text of Exhibit B and Exhibit D were read. The pages of Exhibit C (Regional Privacy Disclosures) were not transcribed, so what this briefing says about them rests on the Trustee's quotation in paragraph 15.
• The 12 million and 120 minutes figures. They are the debtor's, approximate, and reach the filing from its first day declaration. They were not checked against anything else.
• Derived figures. The 103, 18, 17 and 25 per cent figures are arithmetic on dates and amounts the filing prints, and say nothing about intent or timing of any sale.
• Time stamped. The filing was fetched twice on 30 October 2026, and the two copies matched byte for byte. A docket changes by the hour, so a later filing or order may overtake any sentence here.

The question that exposes the gap

When a user was told by a chatbot that a conversation would stay private, and a policy said the company may disclose information on a sale of its assets, which of the two did that user agree to, and who was asked to check?

Key facts