Character.AI bankruptcy: your chats are next, 23andMe proved it

Short answer: What happens to your data when a company goes bankrupt? It gets sold. Bankruptcy court is the biggest data broker in America, and the privacy policy you clicked already said yes: we read 31 consumer app policies and 28 of them let your data move to a buyer, 23 naming bankruptcy outright. 23andMe sold the company holding more than 14 million genetic profiles for $305 million in 2025, about $22 a person. Character.AI, with 12 million monthly users and their chat logs, is in the same court now, with a sale deadline of December 17.

TL;DR: The federal law that is supposed to guard your data in a bankruptcy sale, Section 363(b)(1), only kicks in when the company's own policy forbade the transfer, and 23 of the 31 policies we read pre-authorize it in writing, including OpenAI, Anthropic, Tinder, BetterHelp and Coinbase. Public attention does not last long enough to matter: 23andMe's Wikipedia page jumped to 84,917 views in its bankruptcy month and fell back to 26,817 the next, while the sale closed four months later. Your privacy promise has an expiry date, it is called Chapter 11, and the only data that cannot be sold in it is data the company never had.

Key numbers

What	Number	Source, checked Oct 25 2026
23andMe sale price to TTAM (Regeneron's first bid)	$305M ($256M)	23andMe 8-K, Jun 13 2025
People 23andMe had genotyped; peak market value	14M+; about $6B	Wikipedia, 23andMe
23andMe customers who asked for deletion after the filing	1.9M (about 15%)	Business Insider via Yahoo, Jun 13 2025
Apps whose privacy policy lets a buyer take your data (bankruptcy named)	28 of 31 (23 of 31)	Tensorust read of 40 policies, 31 fetched, Oct 25 2026 (data.csv)
Character.AI monthly users; kids among them	About 12M; at least 2M	KQED, Oct 2026
State attorneys general asking the court for limits on the Character.AI sale	40	Reuters via Insurance Journal, Oct 15 2026
Sleep Number base purchase price; assets include "all ... data and information"	$529.5M	Sleep Number 8-K, Ex. 10.1, Jul 18 2026
RadioShack customer records in its 2015 sale; winning bid for brand plus data	117M; $26.2M	Davis Wright Tremaine, May 19 2015
US startups on Carta that shut down, 2023 vs 2024	769 vs 966	Carta via TechCrunch, Jan 26 2025

The privacy fight everyone watches is the wrong one

The privacy debate is aimed at the living. Ad tracking, data brokers, AI training, the FTC chasing whichever app is in the news. We have covered those fights ourselves, from America's private scoring system to the payroll pipeline at Equifax.

The biggest single transfer of sensitive data in a normal year does not happen in any of those places. It happens in a federal courtroom, in public, with a judge signing off. When a company dies, its customer database is one of the last things on the balance sheet that still has value, and the legal machine is built to turn it into cash for creditors.

That is the boring thing hiding in plain sight. Nobody hacks anything. Nobody breaks a rule. The data walks out the front door under a court order, and the order says the buyer takes it "free and clear."

23andMe: the cleanest receipt we have

23andMe went public through a SPAC in 2021 at a peak value of about $6 billion, per Wikipedia. On March 23, 2025, it filed for Chapter 11 in the Eastern District of Missouri. The same press release promised "no changes to the way the Company stores, manages, or protects customer data" and said it was running a "value-maximizing sale process."

Both lines were true. That is the problem. In May, Regeneron won the first auction at $256 million. The court reopened bidding, and on June 13 TTAM Research Institute, the nonprofit led by co-founder Anne Wojcicki, won at $305 million for substantially all of the assets. The deal closed July 14, 2025.

Do the division. $305 million for a company that had genotyped more than 14 million people is about $22 a person, and that price also bought the research business and the Lemonaid telehealth unit. Your genome, the one piece of data you can never change, cleared court for less than a tank of gas.

The customers did not get a vote. They got a choice to delete, which 1.9 million of them, about 15%, used in the first months, according to interim CEO Joe Selsavage's testimony. Wikipedia's entry also records that users trying to delete found the company kept the data for three years to meet legal obligations. The other 85% went with the assets.

The law protects you only if you never agreed, and you already agreed

Here is the part almost nobody reads. Section 363(b)(1) of the Bankruptcy Code says a debtor may not sell personally identifiable information if its privacy policy prohibited that transfer, unless the sale "is consistent with such policy" or the court approves it after a consumer privacy ombudsman, a neutral adviser appointed under Section 332, weighs in. You can read the statute text at Cornell.

Read that trigger again. The guardrail fires only when the policy forbade the transfer. So we went and read the policies. We pulled 40 privacy policies from the apps that hold the most intimate data people have: genetics, therapy, dating, period and fitness tracking, money, AI chat. 31 loaded cleanly.

23 of the 31 explicitly name bankruptcy, insolvency, dissolution or liquidation as an event where your data can be transferred. Five more name a merger or asset sale without the word bankruptcy. Only three, Grindr, Spotify and Clue, had no transfer clause in the text we could fetch. That is 28 of 31, or 90%, that already pre-approved the sale you think the law protects you from.

The list of the 23 reads like a home screen: 23andMe, Ancestry, Strava, Peloton, BetterHelp, Talkspace, Replika, OpenAI, Anthropic, Tinder, Hinge, Bumble, Life360, Venmo, Robinhood, Coinbase, Discord, Ring, MyFitnessPal, Noom, Hims and Hers, DoorDash and Zoom. OpenAI's policy says a "bankruptcy, receivership" can mean your personal data is "transferred." Anthropic's says it "will receive or disclose your personal data" in a "merger, corporate transaction, bankruptcy." The full list with links is in the data file.

Our reading of how the pieces fit, stated plainly: the 2005 law created a protection, and the industry wrote its policies around it. When the clause is in the policy, a sale is "consistent with such policy," and the ombudsman stops being required. Nobody broke the law. The fine print simply made the law irrelevant before you signed up.

The record shows the speed bump, not the wall

The ombudsman barely shows up in the public record. We searched every SEC filing since 2001 through EDGAR full-text search and found just 17 public companies that even mention a consumer privacy ombudsman, from Circuit City in 2009 to Sears in 2019 to 23andMe in 2025. Most startups that die are private and never file with the SEC at all.

The court dockets are wider. CourtListener's free RECAP archive shows 52 federal cases filed in 2024 alone with documents mentioning a consumer privacy ombudsman. That archive holds only the documents someone paid to pull, so the real number is higher. We tried to count every year and the site rate-limited us, so we stopped there.

And when regulators do step in, the outcome is conditions, not a stop. In 2015, RadioShack put records on 117 million customers into its sale. The FTC wrote to the court that RadioShack had promised never to sell customer information or its mailing lists, and asked for limits modeled on the 2000 Toysmart case. The hedge fund Standard General still won the brand and the customer data with a $26.2 million bid. That is 22 cents a customer for the whole lot.

Follow the money: who the sale is for

A Section 363 sale exists to pay creditors. That is its job, and it does it well. Lenders, secured creditors and the professionals running the case sit at the front of the line. Shareholders sit near the back: Sleep Number's own release said its common shares "would have no recovery" at the agreed price.

Customers are not in the line at all. They are in the inventory. In the 23andMe deal, the consumer "protections" the buyer accepted include two years of free Experian identity-theft monitoring, per the company's own release. That is what the people whose genomes were sold received.

Sleep Number shows how routine this already is. Its smart beds have logged "over 38 billion hours of longitudinal sleep data" from more than 3 million "Smart Sleepers," according to its 2025 10-K. Its July 2026 purchase agreement with Sleep Country Canada sets a base price of $529.5 million, and the assets transferred include "all books and records, documents, files, data and information of the Seller Group." We went deeper on that deal in our sleep tracker piece. Here it is just one more lot.

The next lot is your AI chats

Character.AI filed for Chapter 11 in Delaware on October 12, 2026, which we covered the week it happened. Disney's $20 million opening bid is for a license to some technology and leaves out user data and chats, KQED reports, so any sale of the chats would go to a different buyer. The platform has about 12 million monthly users, including at least 2 million kids who, per the company's own legal filings, spend about two hours a day on it.

Asked whether chats are among the assets for sale, a spokesperson pointed KQED to an FAQ saying user information "continues to be protected" under the privacy policy. The company did not say whether the chats are in the sale or whether that policy would bind a buyer. 40 state attorneys general asked the judge on October 14 for protections and said they may ask for a privacy ombudsman. The sale deadline is December 17.

Now connect it to the startup curve. Carta counted 966 US startup shutdowns in 2024, up from 769 in 2023, and its own head of insights said "we're missing a good chunk." The AI boom funded thousands of companies whose main asset is a log of what people typed to a machine at 2 AM. Companion apps, therapy bots, AI tutors, coding agents. Every one of their policies that we can read lists bankruptcy as a transfer event.

Our bet, and nobody has proven it yet: within two years a bankruptcy auction will draw a bidder who wants nothing but the chat logs, as training data, and the policy will let it through. Conversation data is the scarcest input in AI right now. A dead startup sitting on millions of real human conversations is a gold mine with a court-appointed seller.

The steelman, and why it does not hold

The fair case for the system goes like this. Creditors lent real money and deserve recovery. Buyers usually promise to keep the old policy: TTAM did, and Venmo and Peloton write that requirement into their own policies. Regulators show up in the big cases, as the FTC did with RadioShack, two dozen states did with 23andMe and 40 did with Character.AI. Most of the time the data lands with a company in the same business, not a scammer.

All true, and none of it is a lock. "The buyer keeps the old policy" means the buyer keeps a policy that already allows transfer in the next bankruptcy, and a policy can be rewritten later by whoever owns it. The intervention record shows conditions on the sale, not refusals. And deletion rights only work for people who are paying attention during the one month the story is in the news.

That is what the attention chart above shows. The panic around 23andMe peaked in March 2025 and was gone by April. The sale closed in July. A protection that depends on public outrage lasting four months is not a protection.

The twist: the safest privacy policy is a company that never had your data

Every privacy promise is an IOU from a company that might not exist next year. Startups fail all the time, and in bankruptcy that IOU is just one more thing a court can sell. No regulation fixes this, because the law is working exactly as written: the policy said yes.

The only data that cannot be auctioned is data that never left your machine. Local-first apps, open-weight models running on your own hardware, files you hold yourself. That is not a lifestyle choice anymore. It is the only privacy plan that survives the company dying. We made the same argument about open weights as the real safety plan, and about AI companions you run yourself.

What this means for you

Treat every account as something that will someday be for sale. If you use Character.AI, request your export now: the help center says exports take three to four weeks and the link expires after seven days, so request it, download it, then delete the account before December 17. Do the same audit on any app holding your health, money or private messages: open its privacy policy, search for "bankruptcy," and decide whether that company will still be around in five years.

Then move the sensitive stuff to tools you own. If you want to build your own private, local-first tools with AI instead of renting someone else's, our $29 AI Builder Kit is five offline apps that keep your AI building what you meant, on any model including a local one. If it does not, we keep working with you at no extra cost until it does.

This is our opinion and analysis, not financial advice or legal advice.

More from us: every opinion piece, the opinion archive and our AI industry coverage.

Sources

• 23andMe, Chapter 11 press release (8-K Ex. 99.2), March 24 2025
• 23andMe, agreement for sale to TTAM (8-K Ex. 99.1), June 13 2025
• Wikipedia, 23andMe, read October 25 2026
• Lauren Edmonds, Business Insider via Yahoo, almost 2 million 23andMe users asked to delete their data, June 13 2025
• 11 U.S.C. 363, Cornell LII and 11 U.S.C. 332, read October 25 2026
• FTC, request to protect RadioShack consumers' personal information, May 2015
• Jeanne M. Sheahan and Andrew D. Patterson, Davis Wright Tremaine, RadioShack customer data sale, May 19 2015
• Sleep Number, asset purchase agreement with Sleep Country Canada (8-K Ex. 99.1), June 12 2026
• Sleep Number, amended and restated asset purchase agreement (8-K Ex. 10.1), July 18 2026
• Sleep Number, 2025 Form 10-K, March 12 2026
• KQED, your chatbot just went bankrupt: what happens now to your user data, October 2026
• Dietrich Knauth, Reuters via Insurance Journal, states seek children's data protections in Character.AI bankruptcy, October 15 2026
• Mary Ann Azevedo, TechCrunch, startup shutdowns (Carta data), January 26 2025
• SEC EDGAR full-text search, "consumer privacy ombudsman", 2001 to 2026, Tensorust pull October 25 2026
• CourtListener RECAP search, "consumer privacy ombudsman", Tensorust pull October 25 2026
• Wikimedia pageviews API, 23andMe and Character.ai, Tensorust pull October 25 2026
• Privacy policies of 40 consumer apps (links per app in data.csv), Tensorust read October 25 2026