State attorneys general (AGs) are signaling that AI chatbot user data will face scrutiny, even in bankruptcy. On October 14, 2026, a bipartisan coalition of AGs from 39 states and the District of Columbia filed a notice in the Chapter 11 case of Character Technologies, Inc. (Character.AI), outlining the child-safety and privacy protections they will press for in any sale. The notice comes just days after California announced a $6 million settlement with the successor to 23andMe, resolving claims over 23andMe’s 2023 data breach and ending California’s appeal of the 2025 bankruptcy sale of customers’ genetic data, the closest precedent for a Character.AI sale. AI companies, acquirers, and investors should take note.
Why the States Say the Data Is High Risk
The notice focuses on the sensitivity of Character.AI’s data: account information, including declared ages; chat text and call audio, including health disclosures; behavioral and engagement data; device and tracking identifiers; and payment information. According to the notice, Character.AI had more than 21.6 million U.S. accounts as of March 2025, including more than 2.1 million with a declared age under 18.
The states say chat logs are hard to protect in a sale. Sensitive details may be scattered across long conversations, and references to jobs, homes, or locations can identify users even after names are removed. Health disclosures in those conversations may also trigger consent requirements for sensitive data under state privacy laws, whatever the user’s age. The states also cite consumer-group testing in which “therapist” characters promised confidentiality, contrary to Character.AI’s privacy policy.
Because age verification was allegedly inadequate from 2022 through 2025, minors’ data may be labeled as adult data. This is important because several state data privacy laws require opt-in consent before selling minors’ data or using it for targeted advertising, and some of which extend protections to users up to age 18.
AI training adds another complication. If chat content was used to train or fine-tune models, deleting the underlying records may not remove the data’s influence on those models. Buyers and regulators will likely ask whether the models themselves are part of the data being sold.
What the States Expect From Any Buyer
Character.AI has voluntarily barred users under 18 from open-ended chat, but the states allege the restriction can be circumvented, does not cover features such as “Stories,” and could be reversed by a buyer. They “would advocate” that any purchaser be prepared to comply with state consumer protection and privacy laws, including:
- Age assurance beyond self-declared birthdates;
- Limits on minors’ access to open-ended chats and protection from harmful content elsewhere;
- Removal of characters posing as therapists, doctors, attorneys, or other licensed professionals;
- Crisis protocols for self-harm, suicide, eating-disorder, and substance-abuse content that a click-through cannot bypass;
- A privacy program with reasonable safeguards, accurate disclosures, risk assessments, and consent before processing sensitive data;
- Disclosure of data sales and targeted advertising, with account-level opt-outs that honor prior choices;
- Limits on using chat content for model training or advertising without valid consumer or parental consent;
- Access rights and a chance to delete data before any sale; and
- No misleading claims about safety, suitability for minors, whether characters are human, or their credentials.
These are potential contract terms, not court-ordered conditions. Under Section 363(b)(1) of the Bankruptcy Code, if a debtor’s privacy policy prohibits transferring personal data, the debtor can sell that data only if the sale is consistent with the policy, or if the court approves it after appointing a consumer privacy ombudsman under Section 332. The court must also find that the sale would not violate applicable nonbankruptcy law. Each state has reserved the right to request an ombudsman and to object to any sale, bidding procedures, or plan.
23andMe as a Possible Template
The 23andMe bankruptcy shows how this could unfold. After 23andMe filed for Chapter 11 in March 2025, a coalition of AGs objected to the sale of customers’ genetic data, and the court appointed a consumer privacy ombudsman, who recommended obtaining customers’ affirmative consent before any transfer. The court nonetheless approved a $305 million sale to TTAM Research Institute, a nonprofit formed by 23andMe’s co-founder, finding no conflict with applicable law. Both bankruptcy and district courts rejected California’s objection under its Genetic Information Privacy Act.
Nonetheless, the sale terms addressed many of the concerns raised in the AGs’ objections. TTAM agreed to enhanced data security, risk analysis, an advisory board, compliance with comprehensive state privacy laws without exception, continued deletion rights, and a requirement that any future buyer adopt the same commitments.
Bankruptcy also did not end the states’ claims over the company’s earlier data breach. In July 2026, the successor company agreed to pay $18 million to 42 states over the 2023 breach. On October 19, 2026, California announced a separate $6 million settlement resolving its breach and misrepresentation claims and ending its appeal of the sale order. The California settlement is pending court approval.
Three lessons carry over. First, states may be able to shape the terms of a sale even if they cannot stop it outright, and those terms bind the buyer. Second, the buyer matters: 23andMe’s data went to an entity tied to its founder, and commentators warn that the next sale to an unrelated buyer may carry more risk. Third, the issues in Character.AI’s case may be more complex than in 23andMe’s. Chat logs are less structured than genetic data, the users may include minors who misrepresented their ages, and the data may already be built into AI models.
The Broader Enforcement Picture
The notice follows investigations by several states that began after a 2024 wrongful death suit alleged that a Character.AI chatbot cultivated an emotionally dependent and sexually exploitative relationship with a 14-year-old boy and encouraged his suicidal thoughts. To date, Kentucky is the only state AG to sue, naming the company and its two co-founders in January 2026. In May 2026, Pennsylvania’s State Board of Medicine sued a character posing as a licensed doctor.
While AGs and regulators pursue individual companies, lawmakers are also writing similar protections into law. California’s Adam’s Law (SB 1119), signed September 10, 2026, and taking effect in 2027, is described by its authors as the nation’s first comprehensive framework governing AI chatbots and children. It requires age assurance, risk assessments, crisis referrals, parent-controlled default settings, safeguards against harmful outputs, limits on targeted advertising to children, independent audits, and a private right of action for certain violations.
What Companies Should Do Now
- Diligence the data. Buyers should map what user data exists, where it came from, the privacy policy in effect when it was collected, how users’ ages were determined, and whether it was used to train models. Buyers should also assess exposure to pending or threatened state claims based on pre-bankruptcy conduct, which 23andMe shows can survive the sale process. Review these issues early with counsel.
- Review privacy policy transfer language now. Policies, especially their “business transfer” clauses, will largely decide what can be sold in a future deal or bankruptcy. Companies should review them before financial distress.
- Review chatbot representations. Companies should evaluate chatbot claims and disclosures, including statements by AI characters themselves, for consumer protection risks.
- Assess safeguards and commitments. As 23andMe shows, commitments negotiated with state AGs can become binding sale terms that carry over to future buyers. Companies should consider their enforceability and long-term cost.
- Prepare for Adam’s Law. Companies offering companion chatbots in California should assess their readiness and work with counsel to identify necessary compliance changes before 2027.
Bankruptcy does not shield user data from state scrutiny. The Character.AI notice shows the states applying a framework developed in 23andMe, with closer attention to minors, to AI characters’ behavior, and to model training.
Troutman Pepper Locke State Attorneys General Team
| Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation. |
|
| Clay Friedman – Co-leader Clay co-leads the firm’s State Attorneys General practice and is nationally ranked by Chambers USA for AG Government Relations and in Best Lawyers for Advertising Law. He has dedicated his entire career to state attorney general and federal work, serving for nearly a decade in a senior role and more than 25+ years in private practice. Clay focuses his practice on helping industry-leading companies mitigate the risks associated with state and federal regulatory investigations and associated litigation. |
|
| Chris Carlson Chris advises clients on regulatory, civil, and criminal investigations and litigation. With a background as an assistant attorney general, he provides practical guidance to clients with matters involving state attorneys general and federal regulatory agencies. |
|
| Lauren Fincher Lauren has vast experience handling state attorneys general investigations, navigating complex regulatory compliance matters, and providing strategic counsel in enforcement actions across various industries. She helps clients manage high-stakes regulatory matters and guides them through complex legal landscapes. |
|
| Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, representing clients in single and multistate enforcement actions, including inquiries and investigations involving state attorneys general and other state and federal governmental enforcement bodies including the CFPB and FTC. He regularly represents clients in highly regulated sectors such as financial services, emerging technologies, health care, insurance, and education. |
|
| Michael Yaghi Mike handles high-profile investigations led by state attorneys general, the FTC, and other federal and state regulatory bodies. He assists clients through these complex government inquiries, assisting them throughout the entire life cycle of investigations, from regulatory enforcement through formal litigation. |
|
| Matthew J. Berns Drawing on his experience in senior leadership roles in the New Jersey Attorney General’s and Governor’s Offices and as a trial attorney for the U.S. Department of Justice, Matt provides an insider’s perspective when guiding clients through complex government investigations, litigation, and other actions. |
|
| Reade Jacob Reade counsels gaming companies, financial institutions, fintech and social media platforms, and other commercial clients on regulatory, enforcement, and compliance matters spanning three core areas: gaming and sports betting, consumer protection, and privacy and data security. His gaming practice covers daily fantasy sports investigations, state wagering licensure, social casino litigation, and federal and state gambling compliance. On the consumer protection side, he has represented clients before the CFPB, FTC, and state AGs, negotiating settlements and consent orders, and litigating high-stakes matters in administrative courts and arbitration proceedings. |
|
| Jeff Johnson Jeff helps clients navigate complex regulatory and litigation challenges with local, state, and federal authorities. His clients benefit from his decade of broad litigation experience, understanding of emerging state and federal regulatory issues, and strong relationships with attorneys general across the U.S. In addition to handling cases from trial through state or federal appeals, Jeff serves as amicus counsel in advancing legal rules to support his clients’ vital interests. |
|
| Jay Myers Jay assists clients in heavily regulated industries, including health care, energy, insurance, emerging industries, and data privacy. He provides both regulatory legal advice and government relations strategies. Jay’s past and current clients include Fortune 10 companies, startups, nonprofits, industry associations, and advocacy groups. Recognizing that state government matters are often complex and multifaceted, he utilizes regulatory guidance, government advocacy, or both in tandem to deliver tailored solutions for each client’s unique needs. |
|
| Zoe Schloss Zoe represents clients in litigation and government investigations. As former deputy attorney general for the Delaware Department of Justice, she is an experienced litigator who understands the enforcement priorities that impact her clients. Zoe works with individuals and corporate entities in highly regulated industries, including financial services, health care, and energy. |
|
| Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology. |
|
| Sydney Goldberg Sydney is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. She advises clients on regulatory compliance and state attorney general (AG) investigations in highly regulated industries, including health care and life sciences. She routinely helps clients navigate alcohol compliance and licensing issues, helping proactively manage regulatory risk. |
|
| Troy Homesley Troy is an accomplished litigator who has represented and defended clients across a wide range of complex, high-stakes disputes at both the trial and appellate levels. He has represented technology companies, business executives, law firms, investment funds, high-ranking federal officials, international non-profits, and asylum seekers. Troy draws on his broad litigation experience to advise clients before litigation arises, while claims are pending or threatened, and leading up to and through trial and appeals. |
|
| Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising. Nam’s experience transcends multiple industries, including financial services, telecommunications, media, and sports betting. |
|
| Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general. |
|
| William LaRosa Bill represents clients in complex regulatory investigations, state attorneys general matters, and enforcement proceedings. He draws on his experience as a former assistant U.S. attorney and as a private-sector litigator advising corporations in high-stakes litigation and regulatory investigations, including multistate AG investigations. |
|
| Lane Page Lane represents financial institutions and other clients in federal and state regulatory investigations and complex civil litigation. He is particularly focused on consumer protection and fair lending issues. |
|
| Dascher Pasco Dascher provides strategic counsel and representation to clients navigating regulatory compliance, enforcement, and high-stakes litigation. She regularly represents clients in both single and multistate state attorney general (AG) investigations and enforcement actions, as well as before other state enforcement bodies and local government agencies. |
|
| Kyara Rivera Rivera Kyara is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, cum laude, where she served as publications and online editor of the Public Interest Law Review. |
|
| Timothy Shyu Timothy advises clients on regulatory compliance and enforcement in highly regulated industries, including health care and life sciences, data privacy and cybersecurity, and emerging technology. He assists companies in navigating complex investigations and enforcement actions, helping them mitigate regulatory risk proactively. |
|
| Trey Smith Trey focuses his practice on representing and advising regulated utilities before state public utility commissions. He routinely helps clients obtain certificates of public convenience and necessity for transmission infrastructure. In this role, Trey works with his clients’ subject-matter experts to manage administrative proceedings, including by preparing initial filings; responding to discovery requests; drafting rebuttal testimony; and litigating any disputed issues. |
|
| Daniel Waltz Dan helps clients navigate all aspects highly regulated relationships between industry participants and federal, state and local governments. Whether engaging with regulators, negotiating transactions or representing clients in the courtroom, he delivers solutions that help his clients achieve their strategic goals. |
|
| Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department. |
Recent Comments