.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.webp?width=1220&height=1090&name=Osano-guarantee-seal%20(1).webp)
Think about the last long conversation you had with a chatbot. Now picture that convo listed as an asset in a bankruptcy filing.
That’s the question hanging over Character.AI, which filed for Chapter 11 on Monday to pursue a court-supervised sale. Disney is the opening bidder, offering $20 million for a non-exclusive license to some of the company’s intellectual property and legal claims. What Character.AI hasn’t said is whether user chats are part of what’s for sale. Its privacy policy lets it share “certain information” in a sale of company assets, never defines the term, and doesn’t require a buyer to follow its privacy terms, though the company has said that user data “continues to be protected under our Privacy Policy.”
Regular readers may recall a similar issue cropped up when 23andMe filed for bankruptcy. In that case, the court appointed a consumer privacy ombudsman, who recommended that any buyer honor 23andMe’s existing privacy policies. Federal bankruptcy law allows for a privacy ombudsman to weigh in on cases where the bankrupt company’s privacy policy bars it from transferring personal data to outside parties. So, an independent privacy ombudsman may not be an applicable safeguard in Character.AI’s case.
Privacy policies may not be the most interesting documents in the world, but in cases like these, it’s clear that they’re absolutely essential for companies to focus on and for consumers to understand. Consumers should be able to expect that their data will be managed appropriately regardless of who serves as its steward.
Best,
Arlo
P.S. It’s Delete Week at CalPrivacy (October 12–16), the agency’s push to get Californians to try DROP, its free tool for sending deletion requests to registered data brokers. When Tom Kemp, the agency’s executive director, joined me for a conversation on the Privacy Insider podcast earlier this year, much of it centered on DROP. Give the episode a listen.
New From Osano
Blog: Outfox Software’s Sunk-Cost Fallacy: How to Spot It and Escape
Feel like you just can’t get out from under that one software solution? You thought it was the safe choice when you first picked it, but now it’s causing more problems than its worth. If leaving still feels tough, we can look to psychology to show us how to back off of failing commitments–including commitments to overly complicated, expensive, and frustrating software solutions.
Blog: 5 Questions to Ask AI Vendors Before You Connect Them to Customer Data
Whether you’ve sought out AI-powered tools or your software vendor has added AI into an existing product, you can’t manage the risks they pose until you’ve asked what they are. If digging through pages of AI risk frameworks feels a little overwhelming, these 5 questions (grounded in those same frameworks) is a great starting point.
Tool: OneTrust Migration Calculator
If you’re looking to migrate from OneTrust to Osano, you might be feeling a little traumatized by OneTrust’s lengthy, complicated implementation. But getting started on Osano is straightforward, and with 40% of Osano customers coming from OneTrust, the Osano team has migrated hundreds of companies’ privacy programs before. Use our calculator to estimate what your migration timeline could take based on a few simple details of your privacy program.
In Case You Missed It...
Blog: Florida's CIPA? Why the FSCA Is an Emerging Source of Wiretap Risk
Wiretap demand letters aren't just a California thing anymore. Our latest piece covers how claims are moving to Florida's Security of Communications Act (FSCA), what a demand letter looks like, and which other states have all-party-consent wiretap laws.
Top Privacy Stories of the Week
What Happens to Character.AI Users’ Chats in Bankruptcy?
Character.AI filed for Chapter 11 on Monday to pursue a court-supervised sale, with Disney as the opening bidder at $20 million for a non-exclusive license to some of its intellectual property and legal claims. Its privacy policy allows sharing “certain information” in an asset sale without defining the term or requiring a buyer to follow its privacy terms, and the company hasn’t said whether user chats are among the assets.
Norway Fines Microsoft’s Xandr NOK 92 Million Over Grindr Data
Norway’s data protection authority, Datatilsynet, fined Microsoft-owned adtech company Xandr NOK 92 million, about €8.5 million, for processing Grindr users’ data without a valid legal basis. Xandr never collected consent itself. The regulator found Grindr’s consents invalid and said Xandr’s contract with Grindr didn’t discharge its own accountability. Xandr also deleted records while it knew about the investigation, which Datatilsynet said couldn’t help its case.
Class Action Says OpenAI Skipped Parental Consent for Kids on ChatGPT
A mother filed a proposed class action alleging that ChatGPT sign-up asks children only for a name and a checkbox confirming they’re over 13. The 81-page complaint says OpenAI collected sensitive data from kids, used it to train its models and build profiles, and used age-appropriate slang and emojis to draw out more.
Federal Court Rules DOJ Voter Data Demands Violate Voter Privacy
A federal court found that the Justice Department’s effort to consolidate sensitive voter data violates voter privacy and intrudes on states’ authority over elections. Over the past year, DOJ demanded unredacted voter rolls from 49 states and Washington, D.C., including home addresses, Social Security numbers, and voting history, and planned to compare them against DHS’s SAVE system. The court vacated a policy that, in its words, “has removed United States citizens from the voter rolls in their home states.” Plaintiffs’ counsel says federal judges in 26 states and the 6th Circuit had already rejected the demands.
California Launches First Delete Week as DROP Passes 560,000 Sign-Ups
CalPrivacy is running its first Delete Week, October 12–16, to promote DROP, the state’s Delete Request and Opt-out Platform. More than 560,000 Californians have registered since DROP launched on January 1, and reported deletions of consumer profiles are approaching 100 million. One request reaches more than 660 data brokers, and CalPrivacy says 99.9% of users have had their information deleted by at least one broker.
Like What You See in the Privacy Insider newsletter?
There's more to explore:
🛠️ The Osano Engineering Blog
Learn what we're building, why, and how! New posts released monthly here.
📱 The Osano Subreddit
Join our official subreddit to stay up to date on the latest news, analysis, guidance, and content from Osano!
đź“– The Privacy Insider: How to Embrace Data Privacy and Join the Next Wave of Trusted Brands
The book inspired by this newsletter: Osano CEO, Arlo Gilbert, covers the history of data privacy and how companies can start building a privacy program from the ground up. More details here.
If you’re interested in working at Osano, check out our Careers page!
