A private conversation with an AI chatbot can feel as temporary as a message whispered into a room. Yet the business behind the service may retain records, and those records can become a serious question if the company enters bankruptcy. The October 2026 case involving Character.AI puts AI chatbot privacy into unusually sharp focus. A coalition of US state attorneys general has urged a bankruptcy court to ensure that consumer conversations and children's safety are protected as the company's future is considered. That is a request to the court, not proof that anyone has already sold users' conversations.
The New York Attorney General's announcement on 14 October describes a coalition of 40 attorneys general raising concerns about the service and information it holds. The accompanying court filing sets out their interest in the bankruptcy proceedings. The allegations and requests in those documents matter, but they must not be mistaken for settled judicial findings. The wider issue applies well beyond any one chatbot: what happens to intimate digital records when their custodian's business circumstances change?
AI Chatbot Privacy Does Not End When You Close the Window
People may use conversational AI for work, entertainment, creative writing or personal reflection. Some chats are harmless questions about films or recipes. Others reveal worries, family details, emotional experiences or information about third parties who never agreed to take part in the conversation. The fact that a chatbot can answer in a friendly tone may make the interaction feel private even when the service is operated by a commercial organisation.
The important distinction is between the feeling of a conversation and the technical and legal arrangements governing its records. A chat might be stored in an account history, used according to particular service terms or retained for purposes the user barely remembers approving. Different providers have different policies. The existence of a conversation does not establish who can access it, how long it is kept or what happens when ownership changes. Those questions require examining the particular service and the rules that apply to it.
People sometimes assume that deleting an app from a phone also deletes everything the provider holds. It may not. Uninstalling software generally removes a local application, while server-side records and account information may be managed separately. Equally, deleting a visible conversation does not necessarily explain how backups or legal retention obligations work. A responsible service ought to offer clear information about these distinctions, rather than asking users to deduce them from an interface.
Why a Bankruptcy Court Might Need to Think About Chats
Bankruptcy proceedings are concerned with obligations, assets and what happens to a company that cannot continue in its existing form. Digital businesses can hold valuable systems, brands and datasets as well as debts. That raises a difficult conflict when data contains intimate material supplied by people who never thought of their conversation as a saleable business asset. Legal restrictions and existing privacy promises can be highly relevant, but they depend on the facts and applicable law.
The Character.AI filing is significant because state attorneys general are asking the court and any prospective purchaser to take safety and privacy seriously. Their concern is not just that a user may lose access to a chatbot. It is also that sensitive information and existing risks may need safeguards if the platform changes hands or its operation changes. The public documents are a statement of regulatory position and allegations, rather than a final court decision about the lawful treatment of each record.
This distinction should shape how the story is described. It would be misleading to announce that a buyer has obtained every private chat, or that the court has already ruled on all privacy issues, without direct supporting evidence. The verified development is the coalition's intervention in the case. What it eventually means for individual users will depend on proceedings, applicable obligations and concrete decisions that are not established by this announcement alone.
Children Make the Questions More Difficult
The attorneys general's materials also discuss concerns about children interacting with simulated personalities and receiving harmful or inappropriate responses. Those are serious allegations set out by public officials following their investigations, but each factual contention and any responsibility attributed to the company should be distinguished from an adjudicated finding. A public filing can justify scrutiny without authorising journalists to treat every allegation as already proved by a court.
The privacy problem can be especially sensitive when a younger user has treated an AI character like a companion. A child may reveal feelings or household information that they would not post publicly. A realistic conversational style can also blur the distinction between a responsive programme and a person with genuine duties of care. If those messages are retained, the responsibilities of the operator involve more than the usual question of whether customers can export a contact list.
LiveAIWire previously covered California's attempts to address child safety around AI chatbots. That is a related public-policy discussion, not a claim that the California measures determine this particular bankruptcy case. It helps illustrate the growing concern that providers' product decisions, parental controls and reporting processes can matter greatly when minors use services designed around sustained conversations.
Similarly, our examination of children's trust in conversational AI toys highlights why the way a machine speaks matters. A friendly tone can encourage a child to share more than they would with an obviously mechanical form. That does not make every chatbot harmful, but it increases the importance of honest presentation, careful design and rules about sensitive information.
A Change in Ownership Is Not Just a Technical Migration
When a service changes owner, users may ask whether their existing privacy expectations still apply. Was personal information collected for one stated purpose? Has the provider promised restrictions on sharing or retention? Does the new operator intend to change how the service works? These questions do not have universal answers. Applicable privacy law, contracts and the specifics of the transaction all matter, and different jurisdictions may take different approaches.
A company can also hold information that seems harmless individually but becomes sensitive when combined. A conversational history may reveal routines, relationships, interests or emotional experiences across time. The risk is not confined to whether someone reads one embarrassing message. Long records can make it possible to infer a great deal about a person, especially when linked with account or usage information.
This concern connects to LiveAIWire's report on privacy and the use of chatbot data. The questions about source material and collection are not identical to questions about an existing user conversation, but both involve the gap between what people think happened to their information and what an organisation can actually do with it. Clear, enforceable boundaries are more useful than reassuring language alone.
What Users Can Sensibly Do Now
An individual concerned about a conversational service can begin with the provider's current privacy policy, account settings and documented deletion or export options. The key is to understand what action is actually available and what the provider says it does. If an option allows a user to remove a visible chat, it is worth checking whether the documentation also explains backend deletion or retention. An empty screen is not a legal certificate that no copy remains anywhere.
People can also reduce how much information they provide in future conversations. A service may be useful for brainstorming or learning without receiving an address, account number, a child's full name or private details about somebody else. When discussing sensitive personal situations, it is sensible to think carefully about whether a commercial chatbot is the right recipient. Sharing less information at the beginning can be easier than trying to recover every copy after the fact.
For parents, the most constructive step may be asking which conversational services a child uses and how the child understands them. A young person might regard an AI character as entertainment, a homework helper or a source of comfort. Those uses require different conversations about boundaries. Telling a child that a chatbot is not a confidential professional or trusted adult can be clearer than declaring that every interaction is forbidden or dangerous.
It would also be wrong to promise that deleting an account now will necessarily remove information implicated in ongoing legal proceedings. Retention rules, holds and service practices can affect what happens. The available evidence does not justify a blanket instruction that guarantees the outcome. Users should consult the provider's actual published processes and relevant official advice, particularly if they need guidance about specific rights.
What Regulators and Buyers Need to Explain
If a digital service is transferred or restructured, transparency should be more than a notice buried in a new set of terms. People may need clear explanations of which records are involved, which obligations follow the data, what choices remain and who is responsible for complaints or safeguards. Those decisions can be technically and legally complex. They are still matters that affect ordinary users, including people who never imagined their private words could become part of a corporate proceeding.
The case also raises an incentive problem. A dataset can be useful to an organisation precisely because it contains detailed histories, but that detail may be what makes the material sensitive. The commercial value of information should not be confused with a general permission to use it for any purpose. Trustworthy services have to address the difference in concrete terms, particularly when their users include children or people discussing vulnerable moments.
None of this means that every chatbot company is about to fail or that every conversation is secretly being sold. The Character.AI development is an identifiable US bankruptcy case and a regulatory intervention, not evidence for those sweeping claims. The lesson is structural: privacy questions should be asked when a service is healthy, not only when a court is deciding what happens after its business model breaks down.
The Real Question Is Who Owes the User an Answer
A chatbot can feel intensely personal even when the conversation runs on somebody else's infrastructure. The Character.AI filing reminds us that the fate of a service can matter to the fate of the data it holds. Regulators have publicly requested safeguards; the final legal and operational consequences remain separate questions. Good reporting should follow what the court actually does, rather than confuse a warning with a verdict.
For users, the enduring issue is whether they can understand and exercise meaningful control over their records. For providers, it is whether promises about privacy survive business pressure and changes of ownership. And for anyone designing conversational AI, it is worth remembering that a private-feeling exchange may be remembered by a database long after the person has forgotten it.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity and the social impact of emerging technology. LiveAIWire is an independent, human-led technology publication using AI-assisted research, editorial production and original AI-assisted editorial illustrations under his direction.