Your AI Chats Can Be Sold With the Company. Read the \"Business Transfers\" Line Before You Confide in It

When an AI company goes bankrupt or is bought, a single paragraph in its privacy policy decides what happens to your conversation history. Under US bankruptcy law, that paragraph is the only protection the statute provides — and most AI providers have written it to permit transfer. Here is what five major providers say, and what you can do before a sale closes.

This piece describes what US statutes and published policies say, and what one federal court held. It is not legal advice. The "under US bankruptcy law" qualifier applies throughout — other jurisdictions have different rules.

On October 12, 2026, Character.AI filed for Chapter 11 bankruptcy in the District of Delaware.¹ The company's FAQ says the process is to "pursue a court-supervised sale of all or substantially all of our assets," expected to be "complete by the end of November or perhaps early December 2026."² If no qualifying bid arrives, the platform will be wound down.

That phrase — "substantially all of our assets" — is why this matters to everyone who has ever confided in an AI companion. The chats are not deleted when a company files for bankruptcy. They are, in most cases, a data asset inside the sale.

Whether they travel to a new owner depends on one paragraph most users have never read.

What happens to your data when an AI company is sold?

Under US bankruptcy law, a trustee may sell personal data when the policy permits transfer to non-affiliated parties. If the policy is permissive, no court approval is required — the sale proceeds on commercial terms. Only a policy that prohibits transfer triggers the extra step: court approval and a consumer privacy ombudsman. Most AI providers' policies are permissive.

The mechanism lives in two provisions of the US Bankruptcy Code. 11 U.S.C. §363(b)(1) states that if the debtor's policy "prohibit[s] the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor," then "the trustee may not sell or lease personally identifiable information to any person unless — (A) such sale or such lease is consistent with such policy; or (B) after appointment of a consumer privacy ombudsman … the court approves such sale or such lease."³

In plain language: a prohibiting policy forces a court proceeding with ombudsman oversight. A permissive policy requires neither.

The statute's definition of "personally identifiable information" under §101(41A) is a short enumerated list: name, address, email, phone number, Social Security number, and credit-card number, plus "other information an individual provides the debtor in connection with obtaining a product or service from the debtor."⁴ Whether AI conversation logs fall within that last phrase is an open question — no court has ruled on it directly under §101(41A) — but the language is broad enough that a future court could reasonably read them in.

The statute in two sentences

Under US bankruptcy law, consumer data protection in a bankruptcy sale triggers only when the debtor's policy prohibits transfer — a condition most AI providers have not met. A permissive clause is not a loophole; it is the intended legal path.

The consumer privacy ombudsman process — 11 U.S.C. §332 — is the safeguard Congress added in 2005. The ombudsman is appointed "not later than 7 days before the commencement of the hearing" and may present the debtor's privacy policy, "the potential losses or gains of privacy to consumers," and "potential alternatives that would mitigate potential privacy losses."⁵ In the 23andMe case, this produced a 211-page report.⁶ In a case where the policy is already permissive, the ombudsman process is never triggered.

That asymmetry is what makes the Business Transfers clause load-bearing. A prohibiting clause is the exceptional protection. Most AI providers have chosen the permissive path.

What five AI providers' policies actually say

The Business Transfers clause in a privacy policy is the sentence that determines whether your data can legally travel to an acquirer. The policy in effect on the petition date — not an earlier or later version — is what a US bankruptcy court reads.⁷ Below are five clauses read directly from their primary URLs on October 14, 2026.

Character.AI (Privacy Policy, Effective Date: July 1, 2026, §3 Business Transfers):

"We may disclose certain information, in connection with or during negotiations or closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company."⁸

No notice promise. The clause covers negotiations, not only a completed deal.

Anthropic (Privacy Policy, Effective: September 10, 2026):

"If Anthropic is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, Anthropic will receive or disclose your personal data as part of these corporate transactions."⁹

Explicitly names "bankruptcy." No notice promise.

OpenAI (US Privacy Policy, Updated September 10, 2026):

Permits disclosure when "involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider."¹⁰ Standard permissive pattern. No notice promise.

Replika (Privacy Policy, Business transferees, Last updated: May 27, 2026):

Shares information with acquirers in a "sale, or other disposition of all or any portion of the business or assets … (including, in connection with a bankruptcy or similar proceedings)."¹¹ This companion-AI service explicitly names bankruptcy.

Google (Privacy Policy, Effective: October 1, 2026):

"If Google is involved in a merger, acquisition, or sale of assets, we'll continue to ensure the confidentiality of your personal information and give affected users notice before personal information is transferred or becomes subject to a different privacy policy."¹²

The outlier. Google's clause includes an explicit notice promise before transfer. None of the other four do.

The 23andMe precedent — how the first test played out

The 23andMe bankruptcy (Case 25-40976, Bankr. E.D. Mo.) is the only fully litigated AI-era example of what these rules look like in practice. The company held genetic and health data for approximately 13 million customers.¹³ When it filed in 2025, roughly 1.9 million customers deleted their accounts.¹⁴ The sale was ultimately approved for $305 million.¹⁵

The court's analysis turned on one temporal question: which policy was in effect on the petition date? 23andMe had amended its Privacy Statement in June 2022 to include language noting data could be transferred in a bankruptcy.¹⁶ That was the policy the court read. Judge Brian C. Walsh held that the "policy" triggering §363(b)(1) means the formal privacy policy "in effect on the date of the commencement of the case."⁷

That holding cuts in two directions. In favor of protection: the court warned against an "eve-of-bankruptcy" amendment that converts a prohibiting policy into a permissive one, and noted that state-law privacy restrictions "need not give way to a permissive policy."⁷ In favor of risk: if your provider's policy was already permissive when you signed up — as all five in this table are — a future amendment in your favor cannot help you retroactively.

The FTC's position was stated in a March 31, 2025 letter from Chairman Andrew Ferguson: "promises to consumers must be kept" and that any purchaser should "be bound by and adhere to the terms of 23andMe's privacy policies and applicable law."¹⁷ That is a regulatory expectation, not an enforcement order. It put acquirers on notice; it did not stop the sale.

Consumer privacy ombudsman Neil Richards noted in his 211-page report that customers were given "promises" that were "more visible than the technical language about change in control deep in the Privacy Statement."¹⁸ Millions of customers had never logged in since June 2022 — after the company added the bankruptcy-transfer language to its policy — and so never saw the amendment.¹⁹ The gap between what a company markets and what a buried clause permits is the terrain that matters.

The court ultimately approved the 23andMe sale "subject to the right of customers to opt out of the sale" of their genetic data.²⁰ That opt-out was court-ordered, not promised in the policy. Customers who took no action remained in the default pool.

Side-by-side: five providers, one clause

All five policies permit transfer. Google is the only provider in this table with an explicit notice promise. Four of the five name bankruptcy or "similar proceedings" directly. Character.AI's clause covers negotiations before a deal closes — not just a completed acquisition.

One important precision on Character.AI's current sale process: Disney's stalking-horse bid, announced October 12, 2026, is a $20 million non-exclusive IP license — not a purchase of user data.²¹ The structure of what any approved buyer will acquire, and what obligations toward user data will be imposed, has not been finalized. "Your chats are being sold to Disney" is not the correct framing. What is accurate: the company is in a court-supervised sale process for substantially all its assets, and the policy in effect on October 12, 2026 is permissive.

Three things you can do before the sale closes

Character.AI's FAQ says: "you can delete your account or export your data through the app or the Character.ai website."² That is the lever you have. Professor Christopher G. Bradley, writing in the Hastings Law Journal in 2023, described consumer-data protections in commercial insolvency as amounting to "legal protection is less than most would assume" — a gap he called "privacy theater."²² The gap is real; the three actions below narrow it.

1. Read the clause in your AI app's privacy policy. Search for "Business Transfers," "merger," or "acquisition." Note whether it includes a notice promise. Note the effective date. That is the policy a court would read on the petition date if the company files tomorrow.

2. Export the conversations you want to keep. Do this before the sale closes, not after. Files you hold cannot be part of a vendor's asset sale — they are already in your possession. The step-by-step export guide for major AI providers is in Own Your AI Chat History.

3. Delete what you do not want transferred. In the 23andMe case, 1.9 million customers who deleted their accounts after the filing were not part of the default sale pool.¹⁴ Deletion is not instant and not always complete — the mechanics of what "delete" achieves are covered in What You Type Into an AI Leaves Your Walls — but it is the mechanism the statute and the only fully litigated precedent support.

The window in Character.AI's case is named: the sale is expected to close "by the end of November or perhaps early December 2026."² This is not the same as the shutdown scenario — if the company shuts down entirely, the data disappears; that case is covered in What Happens to Your Notes When the App Shuts Down. In a sale, the data survives under new ownership.

Who should read their clause now?

You should read your AI app's Business Transfers clause if any of the following apply to you:

• You use a companion AI (Character.AI, Replika, or any app built around a persistent relationship persona) — these services hold conversation histories that may span months or years and contain information shared in a private context.
• You use an AI tool at work where conversations include client information, strategic plans, or confidential business data — check whether your employer's data processing agreement addresses change of control.
• You use an AI note-taking tool that sends your notes to a hosted model — your notes may qualify as "information provided in connection with obtaining a service" under §101(41A).
• Your provider has recently cut staff, missed public revenue targets, or raised a down round — financial distress precedes bankruptcy; the petition date is rarely a surprise in hindsight.

You do not need to act urgently if you use an AI service from a well-capitalized company with a strong notice promise, or if your tools are configured to keep conversations on your own device. Local-first tools — where data stays on your device — are not part of any vendor's asset estate.

Frequently Asked Questions

Does deleting my Character.AI account before the sale help?

It is the documented action the statute and the 23andMe precedent support. In 23andMe's case, 1.9 million customers deleted their accounts after the filing, and the court approved the sale "subject to the right of customers to opt out."²⁰ Character.AI's FAQ confirms that deletion is available before the sale closes.² Whether a court-ordered opt-out will apply in Character.AI's case is unknown as of publication. Deleting before the sale closes is the lever users have.

Does the FTC protect me in a bankruptcy data sale?

The FTC's position is that "promises to consumers must be kept" and that any purchaser should "be bound by and adhere to the terms of [the seller's] privacy policies and applicable law."¹⁷ That is a regulatory expectation backed by FTC enforcement authority — not a specific order in Character.AI's case. The FTC intervened in 23andMe's process via letter. FTC oversight is a backstop; it is not a guarantee at the transaction level.

Is my chat history covered by the statute's definition of personally identifiable information?

11 U.S.C. §101(41A) lists name, address, email, phone number, Social Security number, and credit-card number, plus "other information an individual provides the debtor in connection with obtaining a product or service."⁴ The statute does not expressly list AI conversation logs. Whether chat content is covered is an open legal question under §101(41A); no court has held either way. The statute's protection is narrower than most users assume.

What if the sale goes through and a new owner takes my data — does their policy now apply?

The 23andMe court held that the policy on the petition date is what triggers §363(b)(1).⁷ A new owner who acquires data under a permissive policy inherits it on those terms. The new owner's privacy policy will govern going forward. Read it — and note whether it has its own Business Transfers clause.

Does Disney now own my Character.AI chats?

No. Disney's stalking-horse bid is a $20 million non-exclusive IP license, not a purchase of user data.²¹ The sale process is ongoing. No buyer for the broader asset estate has been confirmed as of this writing.

What about EU users and GDPR?

This analysis applies to US bankruptcy law (11 U.S.C. §363 and §332). EU users retain GDPR rights to data portability and erasure, which operate independently of a US bankruptcy sale. The interaction between US Chapter 11 proceedings and GDPR rights for EU-resident users is a complex cross-jurisdictional question outside this piece's scope.

Why does the policy's effective date matter so much?

Because Judge Walsh held that §363(b)(1) is triggered by the policy "in effect on the date of the commencement of the case."⁷ If a company amended its policy to be permissive before filing, that version is what the court reads — even if you enrolled under an earlier, more protective version. The snapshot that counts is the petition date.

The Business Transfers clause is the most consequential sentence in any AI privacy policy, precisely because it governs the scenario no one wants to imagine when they sign up. The time to read it is before the petition is filed.

The files you hold cannot be transferred in someone else's sale.

MNMNOTE keeps your notes on your own device — no account, no vendor's server, nothing to schedule into an asset sale.

References